Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Oct 2012 16:58:44 +0300
From: Henri Salo <>
Cc: Scott Herbert <>,
	Malte Müller <>
Subject: CVE request: Zenphoto admin-news-articles.php date parameter XSS 


Can we assign 2012 CVE-identifier for issue in Zenphoto zp-core/zp-extensions/zenpage/admin-news-articles.php date parameter XSS, thanks.

Not fixed in Will be fixed in next bugfix release beginning of November.

Fix in
foo@bar:~/zenphoto/trunk$ svn diff -r10048:10942 zp-core/zp-extensions/zenpage/admin-news-articles.php
Index: zp-core/zp-extensions/zenpage/admin-news-articles.php
--- zp-core/zp-extensions/zenpage/admin-news-articles.php   (revision 10048)
+++ zp-core/zp-extensions/zenpage/admin-news-articles.php   (revision 10942)
@@ -109,13 +109,13 @@
            <h1><?php echo gettext('Articles'); ?>
            if (isset($_GET['category'])) {
-               echo "<em>".sanitize($_GET['category']).'</em>';
+               echo "<em>".html_encode(sanitize($_GET['category'])).'</em>';
            if (isset($_GET['date'])) {
-               echo '<em><small> ('.$_GET['date'].')</small></em>';
+               $_zp_post_date = sanitize($_GET['date']);
+               echo '<em><small> ('.html_encode($_zp_post_date).')</small></em>';
                // require so the date dropdown is working
-               $_zp_post_date = sanitize($_GET['date']);
            if(isset($_GET['published'])) {
                switch ($_GET['published']) {

- Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.