CVE-2006-4166 PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the image parameter to (1) image.php or (2) image.php2.
HighCVSS 7.5
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the image parameter to (1) image.php or (2) image.php2.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tinywebgallery | <= 1.5 | No fix listed |
| tinywebgallery | = 1.3 | No fix listed |
| tinywebgallery | = 1.4 | No fix listed |
References
- 1393 third-party-advisory
- 1016682 exploit vdb-entry
- 20060810 TinyWebGallery v1.5 ( image ) Remote Include Vulnerability mailing-list
- 20060816 Re: TinyWebGallery v1.5 ( image ) Remote Include Vulnerability mailing-list
- 20060904 Re: TinyWebGallery v1.5 ( image ) Remote Include Vulnerability mailing-list
- tinywebgallery-image-file-include(28317) vdb-entry
- 2158 exploit