vendor:
Photo Manager Pro
by:
Vulnerability Laboratory Research Team
6.9
CVSS
HIGH
Local File Include
98
CWE
Product Name: Photo Manager Pro
Affected Version From: 4.4.2000
Affected Version To: 4.4.2000
Patch Exists: YES
Related CWE: N/A
CPE: a:linkus:photo_manager_pro:4.4.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: iOS
2015
Photo Manager Pro v4.4.0 iOS – File Include Vulnerability
A local file include web vuln. has been discovered in the official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. The vulnerability allows local attackers to inject malicious script codes to the application-side of the vulnerable service. The vulnerability is located in the `file` value of the `index.php` file. Local attackers are able to inject own malicious script codes to the application-side of the vulnerable service. The request method to inject is POST and the attack vector is local.
Mitigation:
Apply the latest security patches and updates to the affected application.