exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Zoph Cross Site Scripting

Zoph Cross Site Scripting
Posted Jul 3, 2010
Authored by Mohammed Boumediane | Site vupen.com

Zoph versions prior to 0.8.0.3 and 0.8.1.1 suffer from cross site scripting vulnerabilities.

tags | advisory, vulnerability, xss
SHA-256 | 990527c729b04c8edb656822e7259ef8d0c7f9140c6abfd9612079b9cda777e5

Zoph Cross Site Scripting

Change Mirror Download
Zoph Multiple Parameter Cross Site Scripting Vulnerabilities


I. BACKGROUND
---------------------

"Zoph (Zoph Organizes Photos) is a web based digital image presentation
and management system. In other words, a photo album. It is built with
PHP, MySQL and Perl."


II. VULNERABILITIES
---------------------

VUPEN Web Vulnerability Research Team discovered multiple vulnerabilities in
Zoph.

These issues are caused by input validation errors in various scripts when
processing the "user_name", "title", "called", "email", "dob",
"middle_name",
"last_name", "first_name", "subject", "message", "photographer_id",
"person_id", "_random", "_rating-op", "rating", "timestamp" and
"_timestamp-op" parameters, which could be exploited to cause arbitrary
scripting code to be executed by the user's browser in the security
context of an affected Web site.


III. AFFECTED PRODUCTS
---------------------------

Zoph versions prior to 0.8.0.3
Zoph versions prior to 0.8.1.1


IV. SOLUTION
----------------

Upgrade to Zoph version 0.8.0.3 or 0.8.1.1 :
http://www.zoph.org/concrete/index.php/download/


V. CREDIT
--------------

These vulnerabilities were discovered by Mohammed Boumediane (VUPEN
Security)
with help of the VUPEN Web Application Security Scanning (WASS) technology:

http://www.vupen.com/english/services/wass-index.php


VI. VUPEN Web Application Security Scanner (WASS)
----------------------------------------------------

VUPEN Web Application Security Scanner (WASS) is a SaaS security scanning
technology which enables corporations and organizations to identify, track
and remediate security vulnerabilities affecting their web sites and
web applications, prevent criminals from gaining unauthorized access to
sensitive data, and comply with security requirements such as PCI.

Read More: http://www.vupen.com/english/services/wass-index.php


VII. REFERENCES
----------------------

http://www.vupen.com/english/advisories/2010/1680
http://www.zoph.org/concrete/index.php/news/security-releases-for-zoph/


VIII. DISCLOSURE TIMELINE
-----------------------------

2010-05-05 - Vendor notified
2010-05-30 - Vendor response
2010-07-02 - Coordinated public Disclosure


Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    18 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    6 Files
  • 28
    May 28th
    12 Files
  • 29
    May 29th
    31 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close