CVE-2006-1668

newimage.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

4.23% chance of exploitation in the next 30 days, 91st percentile

Published

2006-04-07

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/1645

Security advisories

• http://secunia.com/advisories/19478
• http://www.securityfocus.com/bid/17379

References

• CVE Record
• NVD entry