vendor:
Amateur Photographer's Image Gallery
by:
SecurityFocus
7,5
CVSS
HIGH
SQL Injection, Cross-Site Scripting, Arbitrary File Disclosure
89, 79, 200
CWE
Product Name: Amateur Photographer's Image Gallery
Affected Version From: 0.9a
Affected Version To: 0.9a
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012
Amateur Photographer’s Image Gallery Multiple Vulnerabilities
Amateur Photographer's Image Gallery is prone to multiple SQL injection vulnerabilities, a cross-site scripting vulnerability, and an arbitrary file-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and obtain sensitive information from local files on computers running the vulnerable application.
Mitigation:
Input validation should be used to ensure that untrusted data is not used to execute unintended commands or access local files. It is also recommended to disable remote file inclusion and restrict access to sensitive files.
