PT-2002-2448 · Photodb · Photodb

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1726

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhotoDB version 1.4

Description The issue allows remote attackers to bypass authentication. This can be achieved by manipulating the URL with a large Time parameter, non-empty rmtusername and rmtpassword parameters, and an accesslevel parameter that is lower than the access level of the requested page.

Recommendations For PhotoDB version 1.4, consider restricting access to the secure inc.php file until a patch is available, and ensure that the accesslevel parameter is properly validated to prevent unauthorized access.

Fix

Related Identifiers

CVE-2002-1726

Affected Products

Photodb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1726 · Security Note
• http://ifrance.com/kitetoua/tuto/5holes4.txt · Vendor Advisory
• http://online.securityfocus.com/archive/82/270970 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/9002 · Note
• http://securityfocus.com/bid/4669 · Note