PT-2012-5661 · Img Pals · Img Pals Photo Host

Corrado Liotta + 1 · Publicado 2012-09-15 · Atualizado 2012-09-18 · CVE-2012-4926

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Img Pals Photo Host version 1.0

Description The issue concerns a lack of authentication for requests in the approve.php file, allowing remote attackers to modify administrator activation status. This can be achieved by manipulating the u parameter in specific actions, such as app0 to disable or app1 to enable administrator accounts.

Recommendations For Img Pals Photo Host version 1.0, consider temporarily restricting access to the approve.php file until a proper authentication mechanism is implemented to prevent unauthorized changes to administrator accounts. As a mitigation measure, avoid using the u parameter in the affected actions until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-4926

Produtos afetados

Img Pals Photo Host

Referências · 4

• 🔥 http://exploit-db.com/exploits/18544 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html · Exploit
• 🔥 https://exploit-db.com/exploits/18544 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4926 · Nota de Segurança