photopostSQLXSS.txt

Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: High Title: Multiple Sql injection, and multiple XSS vulnerabilities in Photopost PHP Pro Photo Gallery Software. Date: March 29, 2005 Summary: There are multiple sql injection, xss...

PhotoPost < 5.02 RC3 Multiple Content-parsing Vulnerabilities

Binary data 2778.prm...

PhotoPost Pro 5.1 - 'showgallery.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions. The first set of issues ar...

PhotoPost Pro 5.1 - 'showmembers.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions. The first set of issues ar...

PhotoPost Pro 5.1 - showmembers.php?sl SQL Injection

PhotoPost Pro 5.1 - showmembers.php?sl SQL Injection source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to...

PhotoPost Pro 5.1 - showphoto.php?photo SQL Injection

PhotoPost Pro 5.1 - showphoto.php?photo SQL Injection source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to...

PhotoPost Pro 5.1 - Slideshow.php?photo Cross-Site Scripting

PhotoPost Pro 5.1 - Slideshow.php?photo Cross-Site Scripting source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using...

PhotoPost Pro 5.1 - 'Slideshow.php?photo' Cross-Site Scripting

source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions. The first set of issues ar...

PhotoPost Pro 5.1 - showgallery.php Multiple Cross-Site Scripting Vulnerabilities

PhotoPost Pro 5.1 - showgallery.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied...

CVE-2005-0776

adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remote attackers to manipulate other users' photos...

CVE-2005-0775

The reportpost action in misc.php for PhotoPost PHP 5.0 RC3 does not limit the logging data that is sent to the administrator, which allows remote attackers to send large amounts of email to the administrator...

CVE-2005-0778

CVE-2005-0778 affects PhotoPost PHP 5.0 RC3. The vulnerability arises because the upload handling does not fully verify that a file is an image, allowing remote attackers to inject arbitrary Javascript by uploading non-image files with image extensions (e.g., .gif). This results in a potential XS...

CVE-2005-0778

PhotoPost PHP 5.0 RC3 does not fully verify that an uploaded file is an image file, which allows remote attackers to inject arbitrary Javascript by uploading non-image files with an image extension such as .gif...

CVE-2005-0774

SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter...

CVE-2005-0777

PhotoPost PHP 5.0 RC3 is affected by multiple XSS vulnerabilities. Specifically, remote attackers can inject arbitrary script or HTML via (1) the check_tags function and (2) the editbio field in the user profile. The issues arise from unsanitized input in these areas, enabling reflected or stored...

CVE-2005-0776

CVE-2005-0776 affects PhotoPost PHP 5.0 RC3, where adm-photo.php does not properly verify administrative privileges before manipulating photos. This could allow remote attackers to modify other users’ photos. The vulnerability details are described in multiple sources (e.g., NVD entry), but the p...

CVE-2005-0775

CVE-2005-0775 affects PhotoPost PHP 5.0 RC3 where the reportpost action in misc.php fails to limit logging data sent to the administrator, enabling remote attackers to flood the admin with email. The NVD lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complexity, and no a...

CVE-2005-0774

CVE-2005-0774 affects PhotoPost PHP 5.0 RC3. The SQL injection occurs in member.php (and possibly other scripts) via the uid parameter, enabling remote attackers to execute arbitrary SQL commands. This is reported as a high-severity issue (CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P). Connected docum...

CVE-2005-0777

Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via 1 the checktags function or 2 the editbio field in the user profile...

photopost50rc3.txt

PhotoPost 5.0RC3, All Enthusiast, Inc, multiple vulnerabilities March 05 2005 For your consideration. 1. BACKGROUND PhotoPost is a popular commercial image publishing software. Everyone loves showing off their photos! Add PhotoPost to your site, or let us install it for you, and your visitors wil...