[NEWS] Photopost PHP Pro SQL Injection Vulnerability

• Previous message: SecuriTeam: "[NEWS] 0verkill Buffer Overflow Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 3 Feb 2004 14:43:35 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Photopost PHP Pro SQL Injection Vulnerability
------------------------------------------------------------------------

SUMMARY

 <http://www.photopost.com> PhotoPost PHP Pro "lets your users upload and
discuss photos in galleries that you create as well as public and private
albums that they create, and it integrates seamlessly into your current
site design."

There is a flaw in Photopost PHP Pro that allows an attacker to disclose
sensitive information that could be used to gain unauthorized access.

DETAILS

Vulnerable Systems:
 * Photopost PHP Pro version 4.6 and prior

The problems exist due to insufficient sanitization of user-supplied data.
A remote attack could exploit these issues and inject other SQL queries
which might disclose sensitive information.

Example:
http://address/directory/showphoto.php?photo=[query]

Patch Availability:
The vendor has been contacted and a
<http://www.photopost.com/members/forum/showthread.php?s=&threadid=98113>
patch is available.

ADDITIONAL INFORMATION

The information has been provided by <mailto:zetalabs@zone-h.org> G00db0y
of Zone-H security
The original article can be found at:
<http://www.zone-h.org/en/advisories/read/id=3844/>
http://www.zone-h.org/en/advisories/read/id=3844/

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] 0verkill Buffer Overflow Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NT] Multiple Vulnerabilities in 602Pro LAN SUITE 2003 (Incorrect File Permissions, File Reading)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... easy-to-install and manage all-in-one
  server application. ... Multiple vulnerabilities have been discovered in the product
  allowing ... interface) which allow attackers to view sensitive information about users
  ... (Securiteam)
• [UNIX] myPHPCalendar Information Disclosure and File Inclusion
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities
  in the code allow remote attackers to cause the ... This of course reveals a lot of sensitive
  information on the remote ... Each request for any of these URLs: ... (Securiteam)
• [NEWS] Multiple Browsers File Upload Data Disclosure
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The problem exists both with Internet
  Explorer and Firefox, ... attackers can upload sensitive information from client
  ... var saved; ... (Securiteam)
• [UNIX] PhotoPost PHP Pro Multiple Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... PhotoPost PHP Pro suffers
  from multiple SQL injection, ... There are plenty of SQL injection vulnerabilities
  in PhotoPost PHP Pro. ... (Securiteam)
• [NT] Cross Application Scripting in Trend Micros Antivirus Software
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts
  list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus,
  it creates an HTML ... (Securiteam)