Woltlab Burning Board rGallery Plugin 'itemID' Parameter SQL Injection Vulnerability

Bugtraq ID:	31820
Class:	Input Validation Error
CVE:	CVE-2008-4627
Remote:	Yes
Local:	No
Published:	Oct 20 2008 12:00AM
Updated:	Apr 16 2015 05:52PM
Credit:	Five-Three-Nine
Vulnerable:	rGallery rGallery 1.09
Not Vulnerable:	rGallery rGallery 1.20

Woltlab Burning Board rGallery Plugin 'itemID' Parameter SQL Injection Vulnerability

The rGallery plugin for Woltlab Burning Board is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The issue affects rGallery1.09; other versions may also be affected.

Woltlab Burning Board rGallery Plugin 'itemID' Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/31820.py

Woltlab Burning Board rGallery Plugin 'itemID' Parameter SQL Injection Vulnerability

Solution:
The vendor has released an updated version. Please see the references for more information.

Woltlab Burning Board rGallery Plugin 'itemID' Parameter SQL Injection Vulnerability

References:

• rgallery security advisor 20Oct08 (andreas d)
  
• rGallery Homepage (rGallery)