PT-2019-7193 · Zenphoto · Zenphoto

Tim Coen + 1 · Published 2019-12-31 · Updated 2020-01-06 · CVE-2015-5591

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zenphoto versions prior to 1.4.9

Description The issue allows remote administrators to execute arbitrary SQL commands due to a SQL injection vulnerability.

Recommendations For versions prior to 1.4.9, update to version 1.4.9 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-5591

Affected Products

Zenphoto

References · 6

• 🔥 https://exploit-db.com/exploits/37602 · Exploit
• 🔥 http://packetstormsecurity.com/files/132667/ZenPhoto-1.4.8-XSS-SQL-Injection-Traversal.html · Exploit
• http://zenphoto.org/news/zenphoto-1.4.9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5591 · Security Note
• https://openwall.com/lists/oss-security/2015/07/18/3 · Note
• http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto · Note