PhotoPost PHP 5.0 RC3, and later, multiple vulnerabilities

PhotoPost 5.0RC3, All Enthusiast, Inc, multiple vulnerabilities March 05 2005 For your consideration. 1. BACKGROUND PhotoPost is a popular commercial image publishing software. Everyone loves showing off their photos! Add PhotoPost to your site, or let us install it for you, and your visitors wil...

PhotoPost PHP < 5.0.1 Multiple Remote Vulnerabilities

According to its banner, the version of PhotoPost PHP installed on the remote host has several vulnerabilities: - An Access Validation Vulnerability. The 'adm-photo.php' script fails to verify authentication credentials, which allows an attacker to change the properties of thumbnails of uploaded...

CVE-2005-0774

SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter...

All Enthusiast PhotoPost PHP Pro 5.0 - adm-photo.php Arbitrary Image Manipulation

All Enthusiast PhotoPost PHP Pro 5.0 - adm-photo.php Arbitrary Image Manipulation source: https://www.securityfocus.com/bid/12779/info PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution. Multiple remo...

All Enthusiast PhotoPost PHP Pro 5.0 - 'adm-photo.php' Arbitrary Image Manipulation

source: https://www.securityfocus.com/bid/12779/info PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution. Multiple remote vulnerabilities affect All Enthusiast PhotoPost PHP Pro. These issues are due t...

PhotoPost Multiple Vulnerabilities

Binary data 2694.prm...

CVE-2005-0273

Multiple SQL injection vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to execute arbitrary SQL commands via the 1 cat or 2 ppuser parameter...

CVE-2005-0273

CVE-2005-0273 : The OpenVAS/NVD records describe SQL Injection vulnerabilities in PhotoPost PHP’s showgallery.php that allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) ppuser parameters. Affected product: PhotoPost PHP Pro (and PhotoPost up to version 4.86 per the C...

CVE-2005-0274

Summary of CVE-2005-0274 (PhotoPost PHP showgallery.php XSS) The vulnerability is in PhotoPost PHP showgallery.php, where multiple cross-site scripting (XSS) flaws arise from insufficient sanitization of user-supplied input. The affected code path allows remote attackers to inject arbitrary scrip...

CVE-2005-0274

Multiple cross-site scripting XSS vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 si, 3 page, or 4 ppuser parameters...

Multiple PhotoPost Pro Vulnerabilities

GulfTech Security Research January 03, 2005 Vendor : All Enthusiast, Inc. URL : http://www.photopost.com/class/ Version : PhotoPost PHP 4.8.1 && Others Risk : Multiple Vulnerabilities Description: PhotoPost was designed to help you give your users exactly what they want. Your users will be thrill...

PhotoPost.txt

GulfTech Security Research January 03, 2005 Vendor : All Enthusiast, Inc. URL : http://www.photopost.com/class/ Version : PhotoPost PHP 4.8.1 && Others Risk : Multiple Vulnerabilities Description: PhotoPost was designed to help you give your users exactly what they want. Your users will be thrill...

All Enthusiast PhotoPost PHP Pro < 4.8.6 Multiple XSS

Binary data 2484.prm...

CVE-2005-0274

Multiple cross-site scripting XSS vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to inject arbitrary web script or HTML via the 1 cat, 2 si, 3 page, or 4 ppuser parameters...

CVE-2004-0250

SQL injection vulnerability in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain privileges via 1 the product parameter in showproduct.php or 2 the cat parameter in showcat.php...

CVE-2004-0239

SQL injection vulnerability in showphoto.php in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain unauthorized access via the photo variable...

CVE-2004-1870

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the 1 photo parameter to addfav.php, 2 photo parameter to comments.php, 3 credit parameter to comments.php, 4 cat parameter to index.php, 5 ppuser parameter to...

CVE-2004-1871

Multiple cross-site scripting XSS vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ppuser, 2 password, 3 stype, 4 perpage, 5 sort, 6 page, 7 si, or 8 cat parameters to showmembers.php, or the 9 photo name, 10 photo...

PhotoPost PHP Pro 3.x/4.x - 'showgallery.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/9994/info Multiple SQL injection, cross-site scripting and HTML injection vulnerabilities have been identified in the application, which may allow an attacker to execute arbitrary HTML or script code in a user's browser and/or influence SQL query logic to...

PhotoPost < 4.6 - Multiple Vulnerabilities

PhotoPost Multiple Vulnerabilities Vendor: All Enthusiast, Inc Product: PhotoPost Version: = 4.6 Website: http://www.photopost.com/ BID: 9994 CVE: CVE-2004-1870 CVE-2004-1871 OSVDB: 10261 10262 10263 10264 10265 10266 10267 4771 SECUNIA: 11241 Description: PhotoPost was designed to help you give...