Description

SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information.

Remediation

References

CVE-2010-4906

Related Vulnerabilities

WordPress Plugin Popup Like box-Page SQL Injection (3.5.2)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4397)

MongoDb Improper Input Validation Vulnerability (CVE-2019-2389)

PHP-Fusion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2013-1806)

LimeSurvey Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-16177)

Severity

High

Classification

CVE-2010-4906 CWE-138

Tags

Missing Update Known Vulnerabilities