medium6.4Public exploit code
CVE-2012-4926
approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u param…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ImgPals Photo Host 1.0 - Admin Account Disactivation2012-02-29 · webapps · php
Impact
approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Imgpals | Img Pals Photo Host | Version 1.0 |