PhpWebGallery 'comments.php' SQL Injection and Code Execution Vulnerabilities

Bugtraq ID:	31762
Class:	Input Validation Error
CVE:	CVE-2008-4645
Remote:	Yes
Local:	No
Published:	Oct 14 2008 12:00AM
Updated:	May 07 2015 05:22PM
Credit:	EgiX
Vulnerable:	PhpWebGallery PhpWebGallery 1.7.2 PhpWebGallery PhpWebGallery 1.7.1 PhpWebGallery PhpWebGallery 1.7 PhpWebGallery PhpWebGallery 1.5.2 PhpWebGallery PhpWebGallery 1.5.1 PhpWebGallery PhpWebGallery 1.4.1 PhpWebGallery PhpWebGallery 1.3.4 PhpWebGallery PhpWebGallery 1.1 PhpWebGallery PhpWebGallery 1.0
Not Vulnerable:	PhpWebGallery PhpWebGallery 1.7.3

PhpWebGallery 'comments.php' SQL Injection and Code Execution Vulnerabilities

PhpWebGallery is prone to an SQL-injection issue and a code-execution issue because it fails to sufficiently sanitize user-supplied data.

Successfully exploiting the SQL-injection issue may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Exploiting the code-execution issue may allow the attacker to execute arbitrary PHP code in the context of the application.

Versions up to and including PhpWebGallery 1.7.2 are vulnerable.

PhpWebGallery 'comments.php' SQL Injection and Code Execution Vulnerabilities

The following exploit is available:

• /data/vulnerabilities/exploits/31762.php

PhpWebGallery 'comments.php' SQL Injection and Code Execution Vulnerabilities

Solution:
The vendor released PhpWebGallery 1.7.3 to address these issues. Please see the references for more information.


PhpWebGallery PhpWebGallery 1.0

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.1

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.3.4

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.4.1

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.5.1

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.5.2

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.7

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.7.1

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery PhpWebGallery 1.7.2

• PhpWebGallery phpwebgallery-1.7.3.tar.gz
  http://download.gna.org/phpwebgallery/release/1.7/1.7.3/phpwebgallery- 1.7.3.tar.gz

PhpWebGallery 'comments.php' SQL Injection and Code Execution Vulnerabilities

References:

• PhpWebGallery Homepage (PhpWebGallery)