Description
The reportpost action in misc.php for PhotoPost PHP 5.0 RC3 does not limit the logging data that is sent to the administrator, which allows remote attackers to send large amounts of email to the administrator.
References
- 12779 vdb-entry
- photopost-email-security-bypass(19676) vdb-entry
- 20050311 PhotoPost PHP 5.0 RC3, and later, multiple vulnerabilities mailing-list
- 14576 third-party-advisory