4homepages 4images 'admin/categories.php' Multiple SQL Injection Vulnerabilities

Bugtraq ID:	47527
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 21 2011 12:00AM
Updated:	Apr 21 2011 12:00AM
Credit:	High-Tech Bridge
Vulnerable:	4homepages 4images 1.7.9 4homepages 4images 1.7.8 4homepages 4images 1.7.7 4homepages 4images 1.7.6 4homepages 4images 1.7.5 4homepages 4images 1.7.4 4homepages 4images 1.7.3 4homepages 4images 1.7.1 4homepages 4images 1.7
Not Vulnerable:

4homepages 4images 'admin/categories.php' Multiple SQL Injection Vulnerabilities

4homepages 4images is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

4homepages 4images 'admin/categories.php' Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

4homepages 4images 'admin/categories.php' Multiple SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

4homepages 4images 'admin/categories.php' Multiple SQL Injection Vulnerabilities

References:

• [1.7 - 1.7.9] Security fix for sql injection in admin/categories.php (4homepages)
  
• 4images Homepage (4homepages)
  
• HTB22950: SQL injection in 4images (High-Tech Bridge)
  
• HTB22950: SQL injection in 4images ([email protected])