--=Sql injection=-- http://www.target.com/path/comments.php?keyword=charif38@hotmail.fr&author=sweet&cat=1[SQLi]&since=1&sort_by=date&sort_order=DESC&items_number=5 http://www.target.com/path/picture.php?1sweet[SQLi]&action=rate=0 http://www.target.com/path/index.php?/search/10[SQli] --=Stored Xss=-- Admin login required Attack pattern : >' http://www.target.com/path/admin.php?page=tags The POST variable "Nouveau tag" is vulnerable to a stored xss attack http://www.target.com/path/admin.php?page=cat_list The POST variable "Ajouter une catégorie virtuelle" is vulnerable to a stored xss attack --=CSRF=-- Change admin password exploit

Piwigo-2.1.2 Change admin password CSRF

Push the Button

[ thx and RIP to Milw0rm.com , JF - Hamst0r - Keystroke you always be right here 3> ] , inj3ct0r.com , exploit-db.com 1,2,3 VIVA LALGERIE