Photo Share Website
Monthly
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the unauthenticated user registration endpoint (/social/ajax.php?action=signup) to database manipulation via the email parameter. The CVSS 4.0 vector confirms network-exploitable with no authentication, no complexity, and no special attack conditions, while the E:P modifier reflects publicly available exploit code hosted on GitHub. No active exploitation is confirmed in CISA KEV, but the combination of a zero-barrier attack surface and public POC code means any internet-exposed instance should be treated as immediately at risk.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint `/social/ajax.php?action=login` to remote unauthenticated exploitation via the `email` parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the unauthenticated user registration endpoint (/social/ajax.php?action=signup) to database manipulation via the email parameter. The CVSS 4.0 vector confirms network-exploitable with no authentication, no complexity, and no special attack conditions, while the E:P modifier reflects publicly available exploit code hosted on GitHub. No active exploitation is confirmed in CISA KEV, but the combination of a zero-barrier attack surface and public POC code means any internet-exposed instance should be treated as immediately at risk.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint `/social/ajax.php?action=login` to remote unauthenticated exploitation via the `email` parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.