CVE-2023-53916
📋 TL;DR
Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field. When administrators view user information, malicious JavaScript injected into postal code fields executes in their browser context. This affects Zenphoto administrators who manage user data.
💻 Affected Systems
- Zenphoto
📦 What is this software?
Zenphoto by Zenphoto
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full system takeover, data theft, or malware deployment across the Zenphoto installation.
Likely Case
Session hijacking of administrator accounts, unauthorized actions performed by attackers, or data exfiltration from the admin interface.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting individual admin sessions.
🎯 Exploit Status
Exploitation requires admin privileges to inject payload initially, but then affects all administrators viewing user data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.1 or later
Vendor Advisory: https://www.zenphoto.org/news/zenphoto-1.6/
Restart Required: No
Instructions:
1. Backup your Zenphoto installation and database. 2. Download Zenphoto 1.6.1 or later from the official website. 3. Replace all files with the new version, preserving your configuration and uploads. 4. Verify the installation works correctly.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize postal code input before storage
Edit admin-users.php to add postal code sanitization: $postal_code = htmlspecialchars($_POST['postal_code'], ENT_QUOTES, 'UTF-8');
Output Encoding
allEnsure all user data displayed in admin interface is properly HTML-encoded
Modify user display templates to use: echo htmlspecialchars($user['postal_code'], ENT_QUOTES, 'UTF-8');
🧯 If You Can't Patch
- Restrict admin user creation/modification to trusted personnel only
- Implement web application firewall rules to block suspicious postal code patterns
🔍 How to Verify
Check if Vulnerable:
Check Zenphoto version in admin dashboard or by examining the version.php fileCheck Version:
grep "define('ZENPHOTO_VERSION'" zp-core/version.phpVerify Fix Applied:
Test postal code field with XSS payloads like <script>alert('test')</script> and verify they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual postal code entries containing HTML/script tags in user management logs
- Multiple failed login attempts followed by user profile modifications
Network Indicators:
- HTTP POST requests to admin-users.php with script tags in postal code parameter
SIEM Query:
source="web_logs" AND uri="/admin-users.php" AND postal_code="*<script>*"