Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and previous versions allow remote malicious users to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
pixelpost pixelpost 1.5_beta1 |
||
pixelpost pixelpost 1.4.3 |