PT-2005-1955 · Photopost · Photopost Php Pro

Diabolic Crab · Publicado 2005-03-29 · Atualizado 2016-10-18 · CVE-2005-0928

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PhotoPost PHP Pro versions 5.x

Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in several PHP files. The parameters cat, password, ppuser, sort, and si in showgallery.php, parameters ppuser, sort, and si in showmembers.php, and the photo parameter in slideshow.php are affected.

Recommendations For PhotoPost PHP Pro version 5.x, update the software to a version that fixes the XSS vulnerabilities in the showgallery.php, showmembers.php, and slideshow.php files by properly sanitizing user input for the cat, password, ppuser, sort, si, and photo parameters. As a temporary workaround, consider restricting access to these parameters to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0928

Produtos afetados

Photopost Php Pro

Referências · 11

• 🔥 http://securitytracker.com/id?1013581 · Exploit
• 🔥 https://exploit-db.com/exploits/25310 · Exploit
• 🔥 https://exploit-db.com/exploits/25309 · Exploit
• 🔥 https://exploit-db.com/exploits/25308 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0928 · Nota
• http://osvdb.org/15097 · Nota
• http://secunia.com/advisories/14742 · Aviso do Fabricante
• http://osvdb.org/15098 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0928 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111205342909640&w=2 · Nota
• http://osvdb.org/15096 · Nota