Description

SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter.

Remediation

References

CVE-2012-0994

Related Vulnerabilities

MediaWiki Improper Privilege Management Vulnerability (CVE-2018-0503)

WordPress Plugin Post Grid, Post Carousel, & List Category Posts-by Smart Post Show Cross-Site Request Forgery (2.3.4)

WordPress Plugin BeCustom Cross-Site Request Forgery (1.0.5.2)

WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.14)

WordPress Plugin Email Verification for WooCommerce Unspecified Vulnerability (1.8.1)

Severity

Medium

Classification

CVE-2012-0994 CWE-138

Tags

Missing Update Known Vulnerabilities