CVE-2004-1870

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the (1) photo parameter to addfav.php, (2) photo parameter to comments.php, (3) credit parameter to comments.php, (4) cat parameter to index.php, (5) ppuser parameter to showgallery.php, (6) cat parameter to showgallery.php, (7) cat parameter to uploadphoto.php, (8) albumid parameter to useralbums.php, or (9) albumid parameter to useralbums.php.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.16% chance of exploitation in the next 30 days, 67th percentile

Published

2005-05-10

Updated

2024-08-08

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/23885
• https://www.exploit-db.com/exploits/43808

Security advisories

• http://secunia.com/advisories/11241
• http://securitytracker.com/id?1009571
• http://www.securityfocus.com/bid/9994

References

• CVE Record
• NVD entry