Test ID:	1.3.6.1.4.1.25623.1.0.103412
Category:	Web application abuses
Title:	Zenphoto <= 1.4.2 Multiple Vulnerabilities - Active Check
Summary:	Zenphoto is prone to multiple cross-site scripting (XSS); vulnerabilities, an SQL injection (SQLi) vulnerability, and a PHP code injection vulnerability.
Description:	Summary: Zenphoto is prone to multiple cross-site scripting (XSS) vulnerabilities, an SQL injection (SQLi) vulnerability, and a PHP code injection vulnerability. Vulnerability Impact: An attacker can exploit the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials. The PHP code injection can be exploited to inject and execute arbitrary malicious PHP code in the context of the webserver process. An attacker may be able to modify the logic of SQL queries. A successful exploit may allow the attacker to compromise the software, retrieve information, or modify data, other consequences are possible as well. Affected Software/OS: Zenphoto version 1.4.2 and probably prior. Solution: See the references for a solution. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4448 Common Vulnerability Exposure (CVE) ID: CVE-2012-0993 BugTraq ID: 51916 http://www.securityfocus.com/bid/51916 Bugtraq: 20120208 Multiple vulnerabilities in ZENphoto (Google Search) http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html https://www.htbridge.ch/advisory/HTB23070 http://secunia.com/advisories/47875 XForce ISS Database: zenphoto-viewersizeimage-code-execution(73081) https://exchange.xforce.ibmcloud.com/vulnerabilities/73081 Common Vulnerability Exposure (CVE) ID: CVE-2012-0995 XForce ISS Database: zenphoto-multiple-xss(73083) https://exchange.xforce.ibmcloud.com/vulnerabilities/73083
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.