PT-2017-11003 · Unknown · Image-Gallery-With-Slideshow

Larry W. Cashdollar + 1 · Published 2017-09-14 · Updated 2017-09-20 · CVE-2017-1002014

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions image-gallery-with-slideshow version 1.5.2

Description The issue concerns a Blind SQL Injection in the image-gallery-with-slideshow plugin. This occurs via the gallery name parameter in the admin setting.php file.

Recommendations For version 1.5.2, avoid using the gallery name parameter in the affected admin setting.php file until the issue is resolved. As a temporary workaround, consider restricting access to the admin setting.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-1002014

Affected Products

Image-Gallery-With-Slideshow

References · 4

• 🔥 http://vapidlabs.com/advisory.php?v=189 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002014 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1002014 · Vendor Advisory
• https://wordpress.org/plugins/image-gallery-with-slideshow · Note