Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2006-3210

Overview

Vulnerability Score 5.1 5.1
CVE Id CVE-2006-3210
Last Modified 10 Aug 2011 12:00:00
Published 23 Jun 2006 09:06:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity HIGH
Authentication NONE

CVE-2006-3210

Summary

Ralf Image Gallery (RIG) 0.7.4 and other versions before 1.0, when register_globals is enabled, allows remote attackers to conduct PHP remote file inclusion and directory traversal attacks via URLs or ".." sequences in the (1) dir_abs_src parameter in (a) check_entry.php, (b) admin_album.php, (c) admin_image.php, and (d) admin_util.php; and the (2) dir_abs_admin_src parameter in admin_album.php and admin_image.php. NOTE: this issue can be leveraged to conduct cross-site scripting (XSS) attacks.

Vulnerable Systems

Application

  • Le Ralf Ralf Image Gallery 0.6.5

  • Le Ralf Ralf Image Gallery 0.7

  • Le Ralf Ralf Image Gallery 0.7.1

  • Le Ralf Ralf Image Gallery 0.7.2

  • Le Ralf Ralf Image Gallery 0.7.3

  • Le Ralf Ralf Image Gallery 0.7.4

  • Le Ralf Ralf Image Gallery 0.7.5


References

SECUNIA - 20771

XF - rig-dirabssrc-dirabsadminsrc-file-include(27259)

XF - rig-dirabssrc-dirabsadminsrc-xss(27257)

XF - rig-dirabssrc-directory-traversal(27256)

VUPEN - ADV-2006-2477

BID - 18548

BUGTRAQ - 20060627 Re: [MajorSecurity #18] Ralf Image Gallery <=0.7.4 - Multiple XSS, Remote File Include and directory traversal vulnerabilities

BUGTRAQ - 20060620 [MajorSecurity #18] Ralf Image Gallery <=0.7.4 - Multiple XSS, Remote File Include and directory traversal vulnerabilities

OSVDB - 26756

OSVDB - 26755

OSVDB - 26754

OSVDB - 26753

MISC - http://www.majorsecurity.de/advisory/major_rls18.txt

SREASON - 1136

CONFIRM - http://rig.powerpulsar.com/#news


Last Updated: 27 May 2016 10:42:54