PT-2019-7193 · Zenphoto · Zenphoto

Tim Coen + 1 · Publicado 2019-12-31 · Atualizado 2020-01-06 · CVE-2015-5591

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zenphoto versions prior to 1.4.9

Description The issue allows remote administrators to execute arbitrary SQL commands due to a SQL injection vulnerability.

Recommendations For versions prior to 1.4.9, update to version 1.4.9 or later to resolve the issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-5591

Produtos afetados

Zenphoto

Referências · 6

• 🔥 https://exploit-db.com/exploits/37602 · Exploit
• 🔥 http://packetstormsecurity.com/files/132667/ZenPhoto-1.4.8-XSS-SQL-Injection-Traversal.html · Exploit
• http://zenphoto.org/news/zenphoto-1.4.9 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2015/07/18/3 · Nota
• http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5591 · Nota de Segurança