11 lines
No EOL
846 B
Text
11 lines
No EOL
846 B
Text
source: https://www.securityfocus.com/bid/12779/info
|
|
|
|
PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution.
|
|
|
|
Multiple remote vulnerabilities affect All Enthusiast PhotoPost PHP Pro. These issues are due to a failure of the application to validate access rights and user-supplied input.
|
|
|
|
The first issue is an access validation issue that may allow attackers to manipulate images uploaded by arbitrary users. The second issue is a cross-site scripting vulnerability.
|
|
|
|
An attacker may leverage these issues to execute script code in an unsuspecting user's browser and to bypass authentication to execute certain application commands.
|
|
|
|
http://www.example.com/photopost/adm-photo.php?ppaction=manipulate&pid=[IMAGE ID]&dowhat=rebuildthumb&dowhat=rotateccw |