PT-2011-2848
CVE-2011-1063
·
تاريخ النشر
2011-02-22
·
تاريخ التحديث
2018-10-09
الوصف من
CVSS 2.0
4.3
متوسطةالمقاييسAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
Cherry-Design Photopad version 1.2.0
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the
id or data[title] parameters in an edit action to "files.php", or the id parameter in a view action to "gallery.php".Recommendations
For Cherry-Design Photopad version 1.2.0, avoid using the
id and data[title] parameters in the edit action to "files.php" and the id parameter in the view action to "gallery.php" until a patch is available. As a temporary workaround, consider restricting access to the "files.php" and "gallery.php" files to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾