PT-2012-2999

CVE-2012-0994

·

Publicado

2012-02-21

·

Atualizado

2017-08-29

Descrição por

CVSS 2.0
6.0
Média
MétricasAV:N/AC:M/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions ZENphoto version 1.4.2
Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the sortableList parameter in the Manage Albums feature, specifically in the zp-core/admin-albumsort.php file.
Recommendations For ZENphoto version 1.4.2, consider restricting access to the Manage Albums feature until a patch is available. As a temporary workaround, avoid using the sortableList parameter in the affected API endpoint.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Identificadores relacionados
CVE-2012-0994
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com