Sql injection

2013-12-3115:16:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.5%

JSON

SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.

CPENameOperatorVersion
zenphotole1.4.5.3
zenphotoeq1.4.5.1
zenphotoeq1.4.5.2
zenphotoeq1.4.5

Name	Operator	Version
zenphoto	le	1.4.5.3
zenphoto	eq	1.4.5.1
zenphoto	eq	1.4.5.2
zenphoto	eq	1.4.5

References

openwall.com/lists/oss-security/2013/12/29/1

openwall.com/lists/oss-security/2013/12/30/10

seclists.org/bugtraq/2013/Oct/20

www.enkomio.com/Advisory/SOJOBO-ADV-13-01

www.securityfocus.com/bid/62815

www.zenphoto.org/news/zenphoto-1.4.5.4