CVE-2012-0994

Zenphoto 1.4.2 is affected by a SQL injection via the sortableList parameter in zp-core/admin-albumsort.php (CVE-2012-0994). The vulnerability requires the attacker to be authenticated and have access to the Manage Albums function; remote SQL commands can be executed by manipulating the POST sort...

PT-2012-2999

Name of the Vulnerable Software and Affected Versions ZENphoto version 1.4.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the sortableList parameter in the Manage Albums feature, specifically in the zp-core/admin-albumsort.php fil...