Terong PHP Photo Gallery 'index.php' SQL Injection Vulnerability
BID:28626
Info
Terong PHP Photo Gallery 'index.php' SQL Injection Vulnerability
| Bugtraq ID: | 28626 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-1875 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2008 12:00AM |
| Updated: | May 07 2015 05:30PM |
| Credit: | t0pP8uZz and xprog |
| Vulnerable: |
Terong PHP Photo Gallery 1.0 |
| Not Vulnerable: | |
Discussion
Terong PHP Photo Gallery 'index.php' SQL Injection Vulnerability
Terong PHP Photo Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
NOTE: This issue may be related to the vulnerability documented in BID 24710 (Coppermine Photo Gallery Album Password Cookie SQL Injection Vulnerability). We will update this BID as more information emerges.
This issue affects Terong PHP Photo Gallery 1.0; other versions may also be vulnerable.
Terong PHP Photo Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
NOTE: This issue may be related to the vulnerability documented in BID 24710 (Coppermine Photo Gallery Album Password Cookie SQL Injection Vulnerability). We will update this BID as more information emerges.
This issue affects Terong PHP Photo Gallery 1.0; other versions may also be vulnerable.
Exploit / POC
Terong PHP Photo Gallery 'index.php' SQL Injection Vulnerability
An attacker can exploit this issue via a browser.
The following exploit is available:
http://www.example.com/index.php?photo_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password,0x3a,admin),4/**/FROM/**/users/**/WHERE/**/admin
An attacker can exploit this issue via a browser.
The following exploit is available:
http://www.example.com/index.php?photo_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password,0x3a,admin),4/**/FROM/**/users/**/WHERE/**/admin
Solution / Fix
Terong PHP Photo Gallery 'index.php' SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Terong PHP Photo Gallery 'index.php' SQL Injection Vulnerability
References:
References:
- Terong PHP Photo Gallery Homepage (Terong)