PT-2017-11003 · Unknown · Image-Gallery-With-Slideshow

Larry W. Cashdollar + 1 · Publicado 2017-09-14 · Atualizado 2017-09-20 · CVE-2017-1002014

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions image-gallery-with-slideshow version 1.5.2

Description The issue concerns a Blind SQL Injection in the image-gallery-with-slideshow plugin. This occurs via the gallery name parameter in the admin setting.php file.

Recommendations For version 1.5.2, avoid using the gallery name parameter in the affected admin setting.php file until the issue is resolved. As a temporary workaround, consider restricting access to the admin setting.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-1002014

Produtos afetados

Image-Gallery-With-Slideshow

Referências · 4

• 🔥 http://vapidlabs.com/advisory.php?v=189 · Exploit
• https://wordpress.org/plugins/image-gallery-with-slideshow · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002014 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1002014 · Aviso do Fabricante