Photopost ReviewPost PHP Pro up to 2.83 Remote Code Execution

Summaryinfo

A vulnerability, which was classified as critical, has been found in Photopost ReviewPost PHP Pro up to 2.83. Affected is an unknown function. Performing a manipulation results in Remote Code Execution. This vulnerability is known as CVE-2005-0272. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Photopost ReviewPost PHP Pro up to 2.83 (Programming Language Software). This affects an unknown functionality. The manipulation with an unknown input leads to a remote code execution vulnerability. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, which bypasses the intended restrictions.

The weakness was published 05/02/2005 (Website). It is possible to read the advisory at secunia.com. This vulnerability is uniquely identified as CVE-2005-0272 since 02/10/2005. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 2.84 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (18735), Exploit-DB (43821) and Secunia (SA13697†). Similar entries are available at VDB-23629 and VDB-24374. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Photopost

Name

• ReviewPost PHP Pro

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46
• 2.47
• 2.48
• 2.49
• 2.50
• 2.51
• 2.52
• 2.53
• 2.54
• 2.55
• 2.56
• 2.57
• 2.58
• 2.59
• 2.60
• 2.61
• 2.62
• 2.63
• 2.64
• 2.65
• 2.66
• 2.67
• 2.68
• 2.69
• 2.70
• 2.71
• 2.72
• 2.73
• 2.74
• 2.75
• 2.76
• 2.77
• 2.78
• 2.79
• 2.80
• 2.81
• 2.82
• 2.83

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion