Description

Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action.

Remediation

References

CVE-2009-4563

Related Vulnerabilities

Oracle JRE CVE-2018-2627 Vulnerability (CVE-2018-2627)

phpBB Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-16108)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-8389)

WordPress Plugin Cart66 Pro Arbitrary File Disclosure (1.5.3)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-23622)

Severity

Medium

Classification

CVE-2009-4563 CWE-707

Tags

Missing Update Known Vulnerabilities