2BGal Remote SQL Injection Vulnerability

Bugtraq ID:	12083
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2004 12:00AM
Updated:	Dec 22 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to zib zib <[email protected]>.
Vulnerable:	2BGal 2BGal 2.5.1
Not Vulnerable:	2BGal 2BGal 2.5.2

2BGal Remote SQL Injection Vulnerability

A remote SQL injection vulnerability reportedly affects 2Bgal. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.

An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information.

2BGal Remote SQL Injection Vulnerability

The following example is available:

http://www.example.com/2bgal/disp_album.php?id_album=2%20UNION%20SELECT%20passwd%20as%20nom,%20idpere%20FROM%20galbumlist%20LIMIT%201; --

2BGal Remote SQL Injection Vulnerability

Solution:
The vendor has released 2BGal 2.5.2 to address this issue.


2BGal 2BGal 2.5.1

• 2BGal 2BGal 2.5.2
  http://www.ben3w.com/multimedia/dlcounter.php?selfile=2bgal.zip

2BGal Remote SQL Injection Vulnerability

References:

• 2BGal Homepage (ben3w.com)
  
• 2Bgal : 2.4 & 2.5.1 SQL injection Vulnerability (zib zib )