vendor:
PhotoPost PHP Pro
by:
SecurityFocus
6.4
CVSS
MEDIUM
Access Validation and Cross-Site Scripting
79
CWE
Product Name: PhotoPost PHP Pro
Affected Version From: All versions
Affected Version To: All versions
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Any platform that supports PHP script execution
2005
PhotoPost PHP Pro Multiple Remote Vulnerabilities
PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution. Multiple remote vulnerabilities affect All Enthusiast PhotoPost PHP Pro. These issues are due to a failure of the application to validate access rights and user-supplied input. The first issue is an access validation issue that may allow attackers to manipulate images uploaded by arbitrary users. The second issue is a cross-site scripting vulnerability. An attacker may leverage these issues to execute script code in an unsuspecting user's browser and to bypass authentication to execute certain application commands.
Mitigation:
Ensure that user-supplied input is properly validated and that access rights are properly enforced.
