CVEvulnerability

CVE-2004-1870

7.5 HIGH Published 2004-03-29 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-03-29
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the (1) photo parameter to addfav.php, (2) photo parameter to comments.php, (3) credit parameter to comments.php, (4) cat parameter to index.php, (5) ppuser parameter to showgallery.php, (6) cat parameter to showgallery.php, (7) cat parameter to uploadphoto.php, (8) albumid parameter to useralbums.php, or (9) albumid parameter to useralbums.php.

Affected configurations

• photopost photopost php pro 3.1 • photopost photopost php pro 3.2 • photopost photopost php pro 3.3 • photopost photopost php pro 4.0 • photopost photopost php pro 4.1 • photopost photopost php pro 4.6 • photopost photopost php pro 4.8.1

References