PT-2009-4264 · St · St-Gallery

Yenh4Cker · Publicado 2009-05-28 · Atualizado 2017-09-29 · CVE-2009-1799

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ST-Gallery version 0.1 alpha

Description: The issue concerns SQL injection vulnerabilities in the getGalleryImage function. These vulnerabilities can be exploited when magic quotes gpc is disabled, allowing remote attackers to execute arbitrary SQL commands. The vulnerabilities are specifically related to the gallery category and gallery show parameters in the example.php file.

Recommendations: For ST-Gallery version 0.1 alpha, consider disabling the getGalleryImage function until a patch is available, and restrict access to the example.php file to minimize the risk of exploitation. Avoid using the gallery category and gallery show parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1799

Produtos afetados

St-Gallery

Referências · 5

• 🔥 http://marc.info/?l=bugtraq&m=124171333011782&w=2 · Exploit
• 🔥 http://securityfocus.com/bid/34875 · Exploit
• 🔥 https://exploit-db.com/exploits/8636 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50378 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1799 · Nota de Segurança