Zenphoto Stored Cross-Site Scripting Vulnerability in User Postal Code Field

A stored cross-site scripting vulnerability has been identified in Zenphoto version 1.6. The issue resides in the user postal code field within the admin-users.php interface. When administrators view user information that has been imported as HTML, any malicious JavaScript payloads injected into the postal code field are executed in the context of the administrator's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected data.

Reproduction

To reproduce this vulnerability, access the admin-users.php page and edit a user's postal code by injecting a script, such as a JavaScript alert. Once the information is saved and viewed by an administrator, the injected script will execute, demonstrating the cross-site scripting vulnerability.