PT-2026-104028 · Hascheksolutions · Pictshare
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pictshare