| Package | Affected versions | Patched versions |
|---|---|---|
| kwalbum | = 0.5.1= 0.5.10= 0.5.11= 0.5.12= 0.5.2= 0.5.3= 0.5.4= 0.5.6= 0.5.7= 0.5.8= 0.5.9= 0.6.0= 0.6.1= 0.6.10= 0.6.11= 0.6.12= 0.6.13= 0.6.14= 0.6.15= 0.6.16= 0.6.4= 0.6.5= 0.6.6= 0.6.7= 0.6.8= 0.6.9= 0.7.0= 0.7.1= 0.8.0= 0.9.0= 0.9.1= 0.9.2= 0.9.3= 0.9.4= 1.0= 2.0= 2.0.1= 2.0.4≤ 2.0.2 |
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free