Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2007-3905: Zoph before 0.7.0.1 lets attackers run database commands
CVE-2007-3905 · published 19 years ago
Summary
The Zoph photo management software versions older than 0.7.0.1 can be tricked into executing unwanted database queries when a specially crafted value is sent to the _order field on certain pages. This could let a remote user modify or view data they should not access. Update Zoph to version 0.7.0.1 or later, or apply any available patches, to stop the issue.
What to do
- Update debian zoph to version 0.7.0.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | zoph |
< 0.7.0.2-1 Fix: upgrade to 0.7.0.2-1
|
| Debian:13 | debian | zoph |
< 0.7.0.2-1 Fix: upgrade to 0.7.0.2-1
|
| Debian:14 | debian | zoph |
< 0.7.0.2-1 Fix: upgrade to 0.7.0.2-1
|
| – | zoph | zoph |
<= 0.7 cpe:2.3:a:zoph:zoph:*:*:*:*:*:*:*:* |
Original advisory text
SQL injection vulnerability in Zoph before 0.7.0.1 might allow remote attackers to execute arbitrary SQL commands via the _order parameter to (1) photos.php and (2) edit_photos.php.
SQL injection vulnerability in Zoph before 0.7.0.1 might allow remote attackers to execute arbitrary SQL commands via the _order parameter to (1) photos.php and (2) edit_photos.php.
References
- https://security-tracker.debian.org/tracker/CVE-2007-3905 Vendor Advisory
- http://secunia.com/advisories/26077 Patch Vendor Advisory
- http://secunia.com/advisories/27303
- http://sourceforge.net/project/shownotes.php?release_id=523104&group_id=69353
- http://www.debian.org/security/2007/dsa-1389
- http://www.securityfocus.com/bid/24933
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35446
Severity
7.5
High
Timeline
Published19 Jul 2007
Updated4 Nov 2026
First seen28 Sep 2026
Track software like this
Free during beta