CVE-2017-20248
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the intended directory.
Risk Assessment
The risk involves unauthorized access to sensitive system files such as configurations, passwords, or user data, potentially leading to full server compromise.
Recommendation
Immediately update the Apptha Slider Gallery plugin to the latest version or remove it if no patch is available. Additionally, implement input validation and restrict access to the asgallDownload.php file.
Other vulnerabilities in Apptha Slider Gallery
Original NVD description (English source)
Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the intended directory.