Zenphoto viewer_size_image_saved Cookie Value eval() Call Remote PHP Code Execution

high Nessus Plugin ID 58456

Language:

Synopsis

The remote web server contains an application that is affected by a code execution vulnerability.

Description

The remote host contains a Zenphoto installation that can be abused to execute arbitrary PHP code.

In the file 'zp-core/zp-extensions/viewer_size_image.php' the value of the cookie 'viewer_size_image_saved' is not properly sanitized before being used in an 'eval()' call. This can allow arbitrary PHP code to be executed on the server.

Note that exploitation requires the 'viewer_size_image' plugin be enabled in the application, which is not the case by default.

Solution

Upgrade to Zenphoto 1.4.2.1 or later.

Plugin Details

Severity: High

ID: 58456

File Name: zenphoto_viewer_size_image_saved_code_execution.nasl

Version: 1.13

Type: remote

Family: CGI abuses

Published: 3/23/2012

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:zenphoto:zenphoto

Required KB Items: www/zenphoto

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Exploited by Nessus: true

Patch Publication Date: 2/8/2012

Vulnerability Publication Date: 1/19/2012

Exploitable With

Elliot (Zenphoto 1.4.2 RCE)

Reference Information

CVE: CVE-2012-0993

BID: 51916

Detections

Analytics