Zenphoto Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4564)

Description

SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/.

Remediation

References

CVE-2009-4564

Related Vulnerabilities

WordPress Plugin WP Maintenance Mode Cross-Site Scripting (2.2.3)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-11112)

WordPress Plugin Booking Privilege Escalation (2.4)

Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-28346)

WordPress Plugin Appointment Booking Calendar SQL Injection (1.1.23)

Severity

Medium

Classification

CVE-2009-4564 CWE-138