CVE-2004-1870
PhotoPost PHP Pro 4.6.x - SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1870. PoCs published by JeiAr, GulfTech Security.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Photopost PHP Pro, allowing an attacker to extract sensitive information such as user emails by manipulating the 'ppuser' parameter in the URL.
Description
Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the (1) photo parameter to addfav.php, (2) photo parameter to comments.php, (3) credit parameter to comments.php, (4) cat parameter to index.php, (5) ppuser parameter to showgallery.php, (6) cat parameter to showgallery.php, (7) cat parameter to uploadphoto.php, (8) albumid parameter to useralbums.php, or (9) albumid parameter to useralbums.php.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in Photopost PHP Pro, allowing an attacker to extract sensitive information such as user emails by manipulating the 'ppuser' parameter in the URL.
This is a detailed vulnerability writeup for PhotoPost <= 4.6, describing multiple SQL injection, XSS, script injection, and DoS vulnerabilities. It provides URLs and parameters for exploitation but does not include functional exploit code.