BID:10431

PHPoto Picture_view Script Unauthorized Access Vulnerability

Info

PHPoto Picture_view Script Unauthorized Access Vulnerability

Bugtraq ID:	10431
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 28 2004 12:00AM
Updated:	May 28 2004 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	PHPoto PHPoto 0.4 .0-pre-5 PHPoto PHPoto 0.4 .0-pre-4 PHPoto PHPoto 0.4 .0-pre-3 PHPoto PHPoto 0.4 .0-pre-2a PHPoto PHPoto 0.4 .0-pre-2 PHPoto PHPoto 0.4 .0-pre-1 PHPoto PHPoto 0.3.6 PHPoto PHPoto 0.2.5 PHPoto PHPoto 0.1.2

Not Vulnerable:	PHPoto PHPoto 0.4 .0-pre-6

Discussion

PHPoto Picture_view Script Unauthorized Access Vulnerability

PHPoto is prone to an unauthorized access vulnerability that can allow remote users to view any pictures hosted on a site, regardless of the user's privileges.

PHPoto versions PHPoto 0.4.0-pre-5 and prior are prone to this issue.

Exploit / POC

PHPoto Picture_view Script Unauthorized Access Vulnerability

No exploit is required.

Solution / Fix

PHPoto Picture_view Script Unauthorized Access Vulnerability

Solution:
PHPoto 0.4.0-pre-6 is available to address this issue.

PHPoto PHPoto 0.1.2