CVE-2008-3292

EZWebAlbum 1.0 - Unauthenticated Authentication Bypass via photoalbumadmin Cookie

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-3292. PoCs published by Virangar Security.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in EZWebAlbum by manipulating the 'photoalbumadmin' cookie to gain admin access without credentials.

Description

constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Virangar Security · textwebappsphp
https://www.exploit-db.com/exploits/6115

This exploit demonstrates an authentication bypass vulnerability in EZWebAlbum by manipulating the 'photoalbumadmin' cookie to gain admin access without credentials.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: EZWebAlbum (version not specified)
No auth needed
Prerequisites: Victim must visit a malicious link or execute the provided JavaScript
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43938
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6115
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30343
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4033

Scores

EPSS 0.0732
EPSS Percentile 93.6%

Details

CWE
CWE-287
Status published
Products (1)
ezwebalbum/ezwebalbum 1.0
Published Jul 24, 2008
Tracked Since Feb 18, 2026