PHP Code Injection Vulnerability in Zenphoto by Zenphoto Team
CVE-2020-5593

8.8HIGH

Key Information:

Vendor

Zenphoto

Status
Zenphoto
Vendor
CVE Published:
11 June 2020

What is CVE-2020-5593?

In Zenphoto versions prior to 1.5.7, a security flaw allows attackers to perform PHP code injection attacks. This vulnerability can be exploited when a user uploads a specially crafted .zip file, leading to unauthorized code execution within the web application. It is crucial for users to update to the latest version to mitigate this risk and secure their systems against potential attacks.

Affected Version(s)

Zenphoto versions prior to 1.5.7

References

https://www.zenphoto.org/news/zenphoto-1.5.7/
x_refsource_MISC
https://jvn.jp/en/jp/JVN32252648/index.html
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.