Zenphoto viewer_size_image_saved Cookie Value eval() Call Remote PHP Code Execution

Medium Nessus Plugin ID 58456

Synopsis

The remote web server contains an application that is affected by a code execution vulnerability.

Description

The remote host contains a Zenphoto installation that can be abused to execute arbitrary PHP code.

In the file 'zp-core/zp-extensions/viewer_size_image.php' the value of the cookie 'viewer_size_image_saved' is not properly sanitized before being used in an 'eval()' call. This can allow arbitrary PHP code to be executed on the server.

Note that exploitation requires the 'viewer_size_image' plugin be enabled in the application, which is not the case by default.

Solution

Upgrade to Zenphoto 1.4.2.1 or later.

See Also

https://www.htbridge.com/advisory/HTB23070

https://www.zenphoto.org/news/zenphoto-1.4.2.1

Plugin Details

Severity: Medium

ID: 58456

File Name: zenphoto_viewer_size_image_saved_code_execution.nasl

Version: 1.11

Type: remote

Family: CGI abuses

Published: 2012/03/23

Updated: 2018/11/15

Dependencies: 49287

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:zenphoto:zenphoto

Required KB Items: www/zenphoto

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: false

Exploit Ease: No exploit is required

Exploited by Nessus: true

Patch Publication Date: 2012/02/08

Vulnerability Publication Date: 2012/01/19

Exploitable With

Elliot (Zenphoto 1.4.2 RCE)

Reference Information

CVE: CVE-2012-0993

BID: 51916