medium6.5Public exploit code
CVE-2015-5595
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for r…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ZenPhoto 1.4.8 - Multiple Vulnerabilities2015-07-13 · webapps · php
Impact
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zenphoto | Zenphoto | before 1.4.9 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2015/07/18/3
- http://www.zenphoto.org/news/zenphoto-1.4.9
- https://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/
- http://www.openwall.com/lists/oss-security/2015/07/18/3
- http://www.zenphoto.org/news/zenphoto-1.4.9
- https://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/