CVE-2023-53916
BaseFortify
Publication date: 2025-12-17
Last updated on: 2025-12-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zenphoto | zenphoto | 1.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for malicious JavaScript payloads stored in the user postal code field via the admin-users.php interface in Zenphoto 1.6. Since it is a stored XSS, you can inspect the database entries for the postal code field for suspicious scripts. Additionally, monitoring HTTP requests to admin-users.php for unusual input patterns may help. Specific commands are not provided in the resources. [1]
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in Zenphoto 1.6. It occurs in the user postal code field accessed via the admin-users.php interface. Malicious JavaScript code can be injected into the postal code field, and when administrators view this user information rendered as HTML, the injected script executes in their browser.
How can this vulnerability impact me? :
The vulnerability can lead to the execution of malicious JavaScript in the administrator's browser context. This can result in unauthorized actions performed with administrator privileges, theft of sensitive information such as session tokens, or other malicious activities that compromise the security of the system and its data.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding viewing user information in the admin interface until a patch is applied, sanitizing or validating input in the postal code field to prevent script injection, and applying any available updates or patches from Zenphoto. Restricting administrative access and educating administrators about the risk of executing malicious scripts can also help reduce impact. [1]