Family: CGI abuses --> Category: attack
WEBalbum Local File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Checks for file includes in index.php
Detailed Explanation for this Vulnerability Test
The remote web server contains a PHP application that is affected by a
local file include vulnerability.
The remote host is running WEBalbum, a photo album application written
The installed version of WEBalbum fails to sanitize user input to the
'skin2' cookie in 'inc/inc_main.php' before using it to include
arbitrary files. An unauthenticated attacker may be able to read
arbitrary local files or include a local file that contains commands
which will be executed on the remote host subject to the rights of
the web server process.
This flaw is only exploitable if PHP's 'magic_quotes_gpc' is disabled.
See also :
Unknown at this time.
Medium / CVSS Base Score : 6
Click HERE for more information and discussions on this network vulnerability scan.