CVE-2016-4337

CVE-2016-4337 affects Ktools Photostore prior to 4.7.5. The vulnerability is a SQL injection in the admin password-recovery flow (mgr.login.php, recover_login action) that allows remote attackers to execute arbitrary SQL via the email parameter. Publicly documented as a pre-authentication, blind ...

CVE-2008-6648

CVE-2008-6648 describes a remote SQL injection in the Ktools PhotoStore web app. The vulnerability exists in the file crumbs.php (versions 3.4.3 and 3.5.2) and is exploitable via the query parameter gid to about_us.php . It may be related to CVE-2008-6647. The impact is the potential execution of...

CVE-2008-6647

CVE-2008-6647 (and related CVE-2008-6648) maps to SQL injection vulnerabilities in Ktools PhotoStore 3.4.3 (gallery.php via gid) and, for 6648, crumbs.php via gid to about_us.php, with potential arbitrary SQL execution. Connected sources confirm affected files and parameters; no remediation detai...

CVE-2008-6649

CVE-2008-6649 : SQL injection in Ktools PhotoStore component manager/image_details_editor.php affects versions 2.5, 2.9.8, 3.1.0, and up to 3.5.2. The vulnerability allows remote attackers to execute arbitrary SQL commands via the id parameter. Public references (e.g., Exploit-DB, Secunia, OSVDB,...