PT-2006-4058 · Imgallery · Imgallery

R0T + 1 · Published 2006-06-22 · Updated 2017-07-20 · CVE-2006-3163

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IMGallery versions 2.4 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the start or sort parameters in the galeria.php file.

Recommendations For IMGallery versions 2.4 and earlier, update to a version later than 2.4 to resolve the issue. As a temporary workaround, consider restricting access to the galeria.php file to minimize the risk of exploitation. Avoid using the start and sort parameters in the affected file until the issue is resolved.

Fix

Related Identifiers

CVE-2006-3163

Affected Products

Imgallery

References · 10

• http://secunia.com/advisories/20763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3163 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3163 · Note
• http://osvdb.org/26695 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27277 · Note
• http://attrition.org/pipermail/vim/2006-June/000909.html · Note
• http://securityfocus.com/bid/18566 · Note
• http://vupen.com/english/advisories/2006/2471 · Note
• http://pridels0.blogspot.com/2006/06/imgallery-vuln.html · Note
• http://securitytracker.com/id?1016349 · Note