ID de Prueba:	1.3.6.1.4.1.25623.1.0.103412
Categoría:	Web application abuses
Título:	Zenphoto <= 1.4.2 Multiple Vulnerabilities - Active Check
Resumen:	Zenphoto is prone to multiple cross-site scripting (XSS); vulnerabilities, an SQL injection (SQLi) vulnerability, and a PHP code injection vulnerability.
Descripción:	Summary: Zenphoto is prone to multiple cross-site scripting (XSS) vulnerabilities, an SQL injection (SQLi) vulnerability, and a PHP code injection vulnerability. Vulnerability Impact: An attacker can exploit the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials. The PHP code injection can be exploited to inject and execute arbitrary malicious PHP code in the context of the webserver process. An attacker may be able to modify the logic of SQL queries. A successful exploit may allow the attacker to compromise the software, retrieve information, or modify data, other consequences are possible as well. Affected Software/OS: Zenphoto version 1.4.2 and probably prior. Solution: See the references for a solution. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4448 Common Vulnerability Exposure (CVE) ID: CVE-2012-0993 BugTraq ID: 51916 http://www.securityfocus.com/bid/51916 Bugtraq: 20120208 Multiple vulnerabilities in ZENphoto (Google Search) http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html https://www.htbridge.ch/advisory/HTB23070 http://secunia.com/advisories/47875 XForce ISS Database: zenphoto-viewersizeimage-code-execution(73081) https://exchange.xforce.ibmcloud.com/vulnerabilities/73081 Common Vulnerability Exposure (CVE) ID: CVE-2012-0995 XForce ISS Database: zenphoto-multiple-xss(73083) https://exchange.xforce.ibmcloud.com/vulnerabilities/73083
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.