CVE-2005-0929

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• PhotoPost Pro 5.1 - 'showphoto.php?photo' SQL Injection2005-03-28 · webapps · php · Verified
• PhotoPost Pro 5.1 - 'showmembers.php?sl' SQL Injection2005-03-28 · webapps · php · Verified
• PhotoPost PHP 4.6.5 - 'ecard.php' SQL Injection2010-07-23 · webapps · php · Verified

Impact

SQL injection vulnerability in PhotoPost PHP Pro 5.x may allow remote attackers to execute arbitrary SQL commands via (1) the sl parameter to showmembers.php or (2) the photo parameter to showphoto.php.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

References

• NVD record
• CVE.org record
• http://marc.info/?l=bugtraq&m=111205342909640&w=2
• http://marc.info/?l=bugtraq&m=111213719017716&w=2
• http://secunia.com/advisories/14742
• http://securitytracker.com/id?1013581
• http://www.osvdb.org/15099
• http://www.osvdb.org/15100
• http://marc.info/?l=bugtraq&m=111205342909640&w=2
• http://marc.info/?l=bugtraq&m=111213719017716&w=2
• http://secunia.com/advisories/14742
• http://securitytracker.com/id?1013581
• http://www.osvdb.org/15099
• http://www.osvdb.org/15100