PT-2005-4939 · Mcgallery · Mcgallery Pro

Published 2005-12-14 · Updated 2011-03-08 · CVE-2005-4251

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mcGallery PRO versions 2.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id, start, and rand parameters to "show.php", and the album parameter to "index.php".

Recommendations For mcGallery PRO versions 2.2 and earlier, avoid using the id, start, rand, and album parameters in the affected API endpoints until the issue is resolved. As a temporary workaround, consider restricting access to the "show.php" and "index.php" files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-4251

Affected Products

Mcgallery Pro

References · 9

• 🔥 https://exploit-db.com/exploits/26809 · Exploit
• 🔥 https://exploit-db.com/exploits/26810 · Exploit
• 🔥 http://securityfocus.com/bid/15845 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4251 · Security Note
• http://secunia.com/advisories/18039 · Note
• http://osvdb.org/21720 · Note
• http://osvdb.org/21719 · Note
• http://pridels0.blogspot.com/2005/12/mcgallery-pro-vuln.html · Note
• http://vupen.com/english/advisories/2005/2886 · Note