PictShare vulnerabilities

A flaw was found in HaschekSolutions PictShare up to 3.7.1 in the architect function of src/inc/core.php within the File Upload component. The manipulation causes a race condition, and the attack can be initiated remotely. Attack complexity is rated high and exploitability difficult; the exploit has been published and may be used.

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint, which returns the complete raw metadata object without a field whitelist.