CVE-2011-1063

Name of the Vulnerable Software and Affected Versions Cherry-Design Photopad version 1.2.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id or data[title] parameters in an edit action to "files.php", or the id parameter in a view action to "gallery.php".

Recommendations For Cherry-Design Photopad version 1.2.0, avoid using the id and data[title] parameters in the edit action to "files.php" and the id parameter in the view action to "gallery.php" until a patch is available. As a temporary workaround, consider restricting access to the "files.php" and "gallery.php" files to minimize the risk of exploitation.