PT-2005-2899 · Invision · Invision Gallery

James Bercegay · Published 2005-06-09 · Updated 2016-10-18 · CVE-2005-1948

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Gallery versions prior to 1.3.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the comment parameter in an editcomment action or the rating parameter when voting on a photo.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the editcomment action and photo voting functionality to minimize the risk of exploitation. Avoid using the comment and rating parameters in the affected actions until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-1948

Affected Products

Invision Gallery

References · 5

• 🔥 http://gulftech.org/?node=research&article_id=00079-06092005 · Exploit
• 🔥 https://exploit-db.com/exploits/25806 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1948 · Security Note
• http://marc.info/?l=bugtraq&m=111834146710329&w=2 · Note
• http://securityfocus.com/bid/13907 · Note