Secunia

JeiAr has reported multiple vulnerabilities in PhotoPost, which can be exploited by malicious people to conduct Cross Site Scripting, SQL injection, and script insertion attacks.

1) Input passed to certain parameters in various scripts isn't properly verified before it is used in an SQL query. This can be exploited by malicious people to manipulate SQL queries by injecting arbitrary SQL code.

Examples:
addfav.php?photo=[SQL]
comments.php?photo=[SQL]
comments.php?photo=1&cedit=[SQL]
index.php?cat=[SQL]
showgallery.php?ppuser=[SQL]
showgallery.php?cat=[SQL]
uploadphoto.php?cat=[SQL]
useralbums.php?ppaction=delalbum&albumid=[SQL]
useralbums.php?ppaction=editalbum&albumid=[SQL]

2) Certain input passed to the script "showmembers.php" isn't properly verified before it is returned to the user. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site by tricking the user into visiting a malicious website or follow a specially crafted link.

Examples:
showmembers.php?cat=1&si=&page=7&sort=7&perpage=12&ppuser=10[code]
showmembers.php?cat=1&si=&page=7&sort=7&perpage=12&password=[code]
showmembers.php?cat=1&si=&page=7&sort=7&perpage=12&stype=1[code]
showmembers.php?cat=1&si=&page=7&sort=7&perpage=1[code]
showmembers.php?cat=1&si=&page=7&sort=1[code]
showmembers.php?cat=1&si=&page=1[code]
showmembers.php?cat=1&si=1[code]
showmembers.php?cat=1[code]

3) Certain parameters such as photo names, photo descriptions, album names, album descriptions, and others allow URLs to be specified. These can contain references to administrative functions, which will be executed when an administrative user views an album with malicious links.

The vulnerabilities have been reported in PhotoPost 4.6 and prior.

Solution
Edit the source code to ensure that input is properly verified.
Further details available in Customer Area

Provided and/or discovered by
JeiAr of the GulfTech Security Research Team

Original Advisory
http://www.gulftech.org/03282004.php

Deep Links
Links available in Customer Area