[DSECRG-08-033] Local File Include Vulnerability in Pixelpost 1.7.1

Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Date of Public Advisory: 28.07.2008...

PixelPost 1.7.1 (language_full) Local File Inclusion Vulnerability

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Dat...

PixelPost 1.7.1 - 'language_full' Local File Inclusion

Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Date of Public Advisory: 28.07.2008...

DSECRG-08-033.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Date of Public Advisory: 28.07.2008...

PixelPost 1.7.1 - language_full Local File Inclusion

PixelPost 1.7.1 - languagefull Local File Inclusion Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008...

PixelPost 1.7.1 (language_full) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== PixelPost 1.7.1 languagefull Local File Inclusion Vulnerability ================================================================== Digital Security Research Group DSecRG...

Pixelpost cross-site scripting vulnerability

Overview Pixelpost, an open source content management system used for photo albums, etc., contains a cross-site scripting vulnerability. Daiki Fukumori of Secure Sky Technology, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the vendors under Information Security Early Warnin...

PixelPost 1.7.1 File Disclosure

PixelPost 1.7.1 File Disclosure by Charles "real" F. charlesfolathotmail.fr http://realn.free.fr Requires registerglobals = On magicquotesgpc = Off PROOF OF CONCEPT TARGET URL: http://url/addons/copyfolder.php?...

CVE-2008-0358

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parentid parameter...

CVE-2008-0358

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parentid parameter...

CVE-2008-0358

CVE-2008-0358 affects Pixelpost 1.7. The vulnerability is a SQL injection in the index.php component, exploitable via the remote input parameter parent_id . The underlying cause is insufficient sanitization of the user-supplied value, allowing an attacker to inject arbitrary SQL commands through ...

CVE-2008-0358: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parentid parameter...

pixelpost-sql.txt

!/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print " PixelPost 1.7 Blind SQL Injection...

Pixelpost index.php parent_id Parameter SQL Injection

The remote host is running Pixelpost, a photo blog application based on PHP and MySQL. The version of Pixelpost installed on the remote host fails to sanitize input to the 'parentid' parameter of the 'index.php' script before using it to perform database queries. Provided PHP's 'magicquotesgpc'...

PixelPost 1.7 Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print "...

PixelPost 1.7 - Blind SQL Injection

PixelPost 1.7 - Blind SQL Injection !/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print "...

PixelPost 1.7 - Blind SQL Injection

!/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc3 print "-------------------------------------------------------------------------\r\n"; print " PixelPost 1.7 Blind SQL Injection...

JVN#65677118 Pixelpost cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Pixelpost 1.5 RC1-2 and earlier...

CVE-2006-2891

Cross-site scripting XSS vulnerability in admin/index.php for Pixelpost 1-5rc1-2 and earlier allows remote attackers to inject arbitrary HTML or web script via the loginmessage parameter...

Code injection

Pixelpost 1-5rc1-2 and earlier, when registerglobals is enabled, allows remote attackers to gain administrator privileges and conduct other attacks by setting the SESSION"pixelpostadmin" parameter to 1 in calls to admin scripts such as admin/viewinfo.php...