CVE-2012-0993

Name of the Vulnerable Software and Affected Versions ZENphoto version 1.4.2

Description The issue allows remote attackers to execute arbitrary PHP code via the viewer size image saved cookie when the viewer size image plugin is enabled. This is due to an eval injection vulnerability in the zp-core/zp-extensions/viewer size image.php file.

Recommendations For ZENphoto version 1.4.2, consider disabling the viewer size image plugin until a patch is available to prevent exploitation. Restrict access to the viewer size image.php file to minimize the risk of arbitrary PHP code execution. Avoid using the viewer size image saved cookie in the affected plugin until the issue is resolved.