Drupal Brilliant Gallery Module Multiple SQL Injection Vulnerabilities

Bugtraq ID:	31387
Class:	Input Validation Error
CVE:	CVE-2008-4338
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Justin C. Klein Keane
Vulnerable:	Drupal Brilliant Gallery 6.x-1.3 Drupal Brilliant Gallery 6.x-1.2 Drupal Brilliant Gallery 6.x-1.1 Drupal Brilliant Gallery 5.x-4.1 Drupal Brilliant Gallery 5.x-4.0
Not Vulnerable:

Drupal Brilliant Gallery Module Multiple SQL Injection Vulnerabilities

The Brilliant Gallery module for Drupal is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect all versions of Brilliant Gallery.

Drupal Brilliant Gallery Module Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URI is available:
http://example.com/bgchecklist/save/2/2/2'),(3,3,(select pass from
users where uid=1),3),(4,4,4,'4

Drupal Brilliant Gallery Module Multiple SQL Injection Vulnerabilities

Solution:
The vendor has discontinued support for this application. Please see the references for more information.

Drupal Brilliant Gallery Module Multiple SQL Injection Vulnerabilities

References:

• Drupal Homepage (Drupal)
  
• Drupal Brilliant Gallery module SQL injection vulnerability ("Justin C. Klein Keane" )
  
• SA-2008-058 - Brilliant Gallery - SQL Injection (Drupal)