PT-2005-1807 · Photopost · Photopost Php

Igor Franchuk · Publicado 2005-03-20 · Atualizado 2017-07-11 · CVE-2005-0778

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PhotoPost PHP version 5.0 RC3

Description The issue allows remote attackers to inject arbitrary Javascript by uploading non-image files with an image extension, as the software does not fully verify that an uploaded file is an image file.

Recommendations For PhotoPost PHP version 5.0 RC3, consider implementing additional file type verification to ensure only actual image files can be uploaded, and restrict the execution of Javascript code from uploaded files until a proper fix is available.

Correção

Identificadores relacionados

CVE-2005-0778

Produtos afetados

Photopost Php

Referências · 6

• http://securityfocus.com/bid/12779 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0778 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0778 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19679 · Nota
• http://marc.info/?l=bugtraq&m=111065868402859&w=2 · Nota
• http://secunia.com/advisories/14576 · Nota