vendor:
Photo Manager Pro
by:
Vulnerability Laboratory Research Team
8.6
CVSS
CRITICAL
Code Execution
N/A
CWE
Product Name: Photo Manager Pro
Affected Version From: Photo Manager Pro v4.4.0 iOS
Affected Version To: Photo Manager Pro v4.4.0 iOS
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: iOS
2015
Photo Manager Pro 4.4.0 iOS – Code Execution Vulnerability
An arbitrary code execution web vulnerability has been discovered in the official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. The vulnerability allows remote attackers to execute malicious script code to compromise the application or connected device. The vulnerability is located in the `file` value of the `/upload` POST method request. Remote attackers are able to inject own malicious script codes to the application-side of the vulnerable service.
Mitigation:
The vulnerability can be patched by a secure parse and encode of the vulnerable file value in the upload POST method request.