PT-2006-5586 · Photopost · Photopost

Saudi · Published 2006-09-15 · Updated 2018-10-17 · CVE-2006-4828

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhotoPost versions 4.0 through 4.6

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the PP PATH parameter in the zipndownload.php file. This enables attackers to potentially gain control over the affected system.

Recommendations For PhotoPost versions 4.0 through 4.6, consider restricting access to the zipndownload.php file until a patch is available. As a temporary workaround, avoid using the PP PATH parameter in the affected file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-4828

Affected Products

Photopost

References · 7

• 🔥 https://exploit-db.com/exploits/2369 · Exploit
• 🔥 http://securityfocus.com/bid/20028 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4828 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28948 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4828 · Note
• http://securityreason.com/securityalert/1581 · Note
• http://securityfocus.com/archive/1/446031/100/0/threaded · Note