Zenphoto 1.4.3.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Multiple Vulnerabilities in Zenphoto 1.4.3.3 Author: Janek Vind "waraxe" Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-96.html Description of vulnerable software: Zenphoto is a standalone CMS for multimedia focused websites. Our...

ZenPhoto - 'admin-news-articles.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/55755/info Zenphoto is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affect...

ZenPhoto - admin-news-articles.php Cross-Site Scripting

ZenPhoto - admin-news-articles.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55755/info Zenphoto is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Zenphoto 1.4.3.2 Cross Site Scripting

------------------------- Affected products: ------------------------- Product : Zenphoto 1.4.3.2 and maybe older fixed in 1.4.3.3 Affected function: printPublishIconLink ---------- Details: ---------- The file admin-news-articles.php calls the function printPublishIconLink which generates HTML...

CVE-2012-2641

Cross-site scripting XSS vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library...

Cross site scripting

Cross-site scripting XSS vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library...

CVE-2012-2641

Zenphoto contains a cross-site scripting (XSS) vulnerability in versions 1.4.2.4 and earlier (Zenphoto before 1.4.3). The issue allows an attacker to trigger improper interaction with an unspecified library to execute arbitrary script in a victim’s browser. This is a client-side impact with poten...

CVE-2012-2641

Cross-site scripting XSS vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library...

Zenphoto vulnerable to cross-site scripting

Overview Zenphoto contains a cross-site scripting vulnerability. Zenphoto is a content management system CMS. Zenphoto contains a cross-site scripting vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

JVN#59842447: Zenphoto vulnerable to cross-site scripting

Zenphoto is a content management system CMS. Zenphoto contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version according to the information provided by the developer. Products...

Zenphoto 1.4.2 RCE

Remote command execution vulnerability in ZENPhoto viewersizeimage.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Zenphoto 404 Error Page XSS

The remote host contains a Zenphoto installation that is affected by a cross-site scripting vulnerability. User-supplied input that is appended to the end of a URL is not validated properly before being sent to the browser in a custom 404 page and can result in an attacker-controlled script runni...

Zenphoto viewer_size_image_saved Cookie Value eval() Call Remote PHP Code Execution

The remote host contains a Zenphoto installation that can be abused to execute arbitrary PHP code. In the file 'zp-core/zp-extensions/viewersizeimage.php' the value of the cookie 'viewersizeimagesaved' is not properly sanitized before being used in an 'eval' call. This can allow arbitrary PHP cod...

Zenphoto < 1.4.2.1 Multiple Vulnerabilities

The remote host contains a version of Zenphoto earlier than 1.4.2.1 that is affected by multiple vulnerabilities : - An input validation error in the file 'zp-core/zp-extensions/viewersizeimage.php' can allow arbitrary PHP code to be injected via the value of the cookie 'viewersizeimagesaved...

CVE-2012-0995

Multiple cross-site scripting XSS vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in an external action to zp-core/admin.php, 2 PATHINTO to an unspecified URL, as demonstrated using /1/, 3 PATHINFO to zp-core/admin.php, or 4...

Sql injection

SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in an external action to zp-core/admin.php, 2 PATHINTO to an unspecified URL, as demonstrated using /1/, 3 PATHINFO to zp-core/admin.php, or 4...

Sql injection

Eval injection vulnerability in zp-core/zp-extensions/viewersizeimage.php in ZENphoto 1.4.2, when the viewersizeimage plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewersizeimagesaved cookie...

CVE-2012-0994

Zenphoto 1.4.2 is affected by a SQL injection via the sortableList parameter in zp-core/admin-albumsort.php (CVE-2012-0994). The vulnerability requires the attacker to be authenticated and have access to the Manage Albums function; remote SQL commands can be executed by manipulating the POST sort...

CVE-2012-0995

Multiple cross-site scripting XSS vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in an external action to zp-core/admin.php, 2 PATHINTO to an unspecified URL, as demonstrated using /1/, 3 PATHINFO to zp-core/admin.php, or 4...