94 matches found
CVE-2005-0929
SQL injection vulnerability in PhotoPost PHP Pro 5.x may allow remote attackers to execute arbitrary SQL commands via 1 the sl parameter to showmembers.php or 2 the photo parameter to showphoto.php...
CVE-2005-0928
Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 password, 3 ppuser, 4 sort, or 5 si parameters to showgallery.php, the 6 ppuser, 7 sort, or 8 si parameters to showmembers.php, or 9 the photo...
CVE-2005-0928: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 password, 3 ppuser, 4 sort, or 5 si parameters to showgallery.php, the 6 ppuser, 7 sort, or 8 si parameters to showmembers.php, or 9 the photo...
CVE-2005-0929: Undefined Security Weakness
SQL injection vulnerability in PhotoPost PHP Pro 5.x may allow remote attackers to execute arbitrary SQL commands via 1 the sl parameter to showmembers.php or 2 the photo parameter to showphoto.php...
photopostSQLXSS.txt
Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: High Title: Multiple Sql injection, and multiple XSS vulnerabilities in Photopost PHP Pro Photo Gallery Software. Date: March 29, 2005 Summary: There are multiple sql injection, xss...
CVE-2005-0776
adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remote attackers to manipulate other users' photos...
CVE-2005-0774
SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter...
CVE-2005-0778
PhotoPost PHP 5.0 RC3 does not fully verify that an uploaded file is an image file, which allows remote attackers to inject arbitrary Javascript by uploading non-image files with an image extension such as .gif...
CVE-2005-0776
CVE-2005-0776 affects PhotoPost PHP 5.0 RC3, where adm-photo.php does not properly verify administrative privileges before manipulating photos. This could allow remote attackers to modify other users’ photos. The vulnerability details are described in multiple sources (e.g., NVD entry), but the p...
CVE-2005-0775
CVE-2005-0775 affects PhotoPost PHP 5.0 RC3 where the reportpost action in misc.php fails to limit logging data sent to the administrator, enabling remote attackers to flood the admin with email. The NVD lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complexity, and no a...
CVE-2005-0774
CVE-2005-0774 affects PhotoPost PHP 5.0 RC3. The SQL injection occurs in member.php (and possibly other scripts) via the uid parameter, enabling remote attackers to execute arbitrary SQL commands. This is reported as a high-severity issue (CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P). Connected docum...
CVE-2005-0777
Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via 1 the checktags function or 2 the editbio field in the user profile...
CVE-2005-0775: Undefined Security Weakness
The reportpost action in misc.php for PhotoPost PHP 5.0 RC3 does not limit the logging data that is sent to the administrator, which allows remote attackers to send large amounts of email to the administrator...
CVE-2005-0778: Undefined Security Weakness
PhotoPost PHP 5.0 RC3 does not fully verify that an uploaded file is an image file, which allows remote attackers to inject arbitrary Javascript by uploading non-image files with an image extension such as .gif...
CVE-2005-0777: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via 1 the checktags function or 2 the editbio field in the user profile...
PhotoPost PHP < 5.0.1 Multiple Remote Vulnerabilities
According to its banner, the version of PhotoPost PHP installed on the remote host has several vulnerabilities: - An Access Validation Vulnerability. The 'adm-photo.php' script fails to verify authentication credentials, which allows an attacker to change the properties of thumbnails of uploaded...
CVE-2005-0774
SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter...
All Enthusiast PhotoPost PHP Pro 5.0 - adm-photo.php Arbitrary Image Manipulation
All Enthusiast PhotoPost PHP Pro 5.0 - adm-photo.php Arbitrary Image Manipulation source: https://www.securityfocus.com/bid/12779/info PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution. Multiple remo...
All Enthusiast PhotoPost PHP Pro 5.0 - 'adm-photo.php' Arbitrary Image Manipulation
source: https://www.securityfocus.com/bid/12779/info PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution. Multiple remote vulnerabilities affect All Enthusiast PhotoPost PHP Pro. These issues are due t...