PixelPost 1.7.1 File Disclosure

PixelPost 1.7.1 File Disclosure by Charles "real" F. charlesfolathotmail.fr http://realn.free.fr Requires registerglobals = On magicquotesgpc = Off PROOF OF CONCEPT TARGET URL: http://url/addons/copyfolder.php?...

CVE-2008-0358

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parentid parameter...

CVE-2008-0358

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parentid parameter...

CVE-2008-0358

CVE-2008-0358 affects Pixelpost 1.7. The vulnerability is a SQL injection in the index.php component, exploitable via the remote input parameter parent_id . The underlying cause is insufficient sanitization of the user-supplied value, allowing an attacker to inject arbitrary SQL commands through ...

pixelpost-sql.txt

!/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print " PixelPost 1.7 Blind SQL Injection...

Pixelpost index.php parent_id Parameter SQL Injection

The remote host is running Pixelpost, a photo blog application based on PHP and MySQL. The version of Pixelpost installed on the remote host fails to sanitize input to the 'parentid' parameter of the 'index.php' script before using it to perform database queries. Provided PHP's 'magicquotesgpc'...

PixelPost 1.7 Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print "...

PixelPost 1.7 - Blind SQL Injection

PixelPost 1.7 - Blind SQL Injection !/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print "...

PixelPost 1.7 - Blind SQL Injection

!/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print " PixelPost 1.7 Blind SQL Injection...

JVN#65677118 Pixelpost cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Pixelpost 1.5 RC1-2 and earlier...

CVE-2006-2891

Cross-site scripting XSS vulnerability in admin/index.php for Pixelpost 1-5rc1-2 and earlier allows remote attackers to inject arbitrary HTML or web script via the loginmessage parameter...

Code injection

Pixelpost 1-5rc1-2 and earlier, when registerglobals is enabled, allows remote attackers to gain administrator privileges and conduct other attacks by setting the SESSION"pixelpostadmin" parameter to 1 in calls to admin scripts such as admin/viewinfo.php...

CVE-2006-2890

Pixelpost 1-5rc1-2 and earlier, when registerglobals is enabled, allows remote attackers to gain administrator privileges and conduct other attacks by setting the SESSION"pixelpostadmin" parameter to 1 in calls to admin scripts such as admin/viewinfo.php...

Sql injection

Multiple SQL injection vulnerabilities in index.php in Pixelpost 1-5rc1-2 and earlier allow remote attackers to execute arbitrary SQL commands, and leverage them to gain administrator privileges, via the 1 category or 2 archivedate parameter...

CVE-2006-2889

Multiple SQL injection vulnerabilities in index.php in Pixelpost 1-5rc1-2 and earlier allow remote attackers to execute arbitrary SQL commands, and leverage them to gain administrator privileges, via the 1 category or 2 archivedate parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/index.php for Pixelpost 1-5rc1-2 and earlier allows remote attackers to inject arbitrary HTML or web script via the loginmessage parameter...

CVE-2006-2890

Pixelpost 1-5rc1-2 and earlier are affected when register_globals is enabled. An attacker can set _SESSION["pixelpost_admin"] = 1 in admin scripts (e.g., admin/view_info.php) to gain administrator privileges and perform other attacks. No explicit remediation is provided in the provided documents.

CVE-2006-2889

Multiple SQL injection vulnerabilities in index.php in Pixelpost 1-5rc1-2 and earlier allow remote attackers to execute arbitrary SQL commands, and leverage them to gain administrator privileges, via the 1 category or 2 archivedate parameter...

CVE-2006-2889

CVE-2006-2889 relates to multiple SQL injection flaws in Pixelpost’s index.php, affecting versions 1-5rc1-2 and earlier. The vulnerability is triggered via unsafely constructed queries using user-supplied input from the category and archivedate parameters, enabling remote attackers to execute arb...

CVE-2006-2891

Pixelpost’s admin/index.php (versions 1-5rc1-2 and earlier) contains a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML or web script through the loginmessage parameter. The vulnerability is described across multiple sources (NVD and related records) with the ...