PT-2005-1807 · Photopost · Photopost Php

Igor Franchuk · Published 2005-03-20 · Updated 2017-07-11 · CVE-2005-0778

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PhotoPost PHP version 5.0 RC3

Description The issue allows remote attackers to inject arbitrary Javascript by uploading non-image files with an image extension, as the software does not fully verify that an uploaded file is an image file.

Recommendations For PhotoPost PHP version 5.0 RC3, consider implementing additional file type verification to ensure only actual image files can be uploaded, and restrict the execution of Javascript code from uploaded files until a proper fix is available.

Fix

Related Identifiers

CVE-2005-0778

Affected Products

Photopost Php

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0778 · Security Note
• http://securityfocus.com/bid/12779 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0778 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19679 · Note
• http://marc.info/?l=bugtraq&m=111065868402859&w=2 · Note
• http://secunia.com/advisories/14576 · Note