PT-2025-23924 · Unknown · Media Gallery

Kamil Szczurowski + 1 · Published 2025-06-05 · Updated 2025-06-05 · CVE-2025-27753

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RSMediaGallery component versions 1.7.4 through 2.1.6

Description A SQL injection issue was discovered due to the use of unescaped user-supplied parameters in SQL queries within the dashboard component. This allows an authenticated attacker to inject malicious SQL code through unsanitized input fields, which are used directly in SQL queries. Exploiting this flaw can lead to unauthorized database access, data leakage, or modification of records.

Recommendations For versions 1.7.4 through 2.1.6, consider disabling the use of user-supplied parameters in SQL queries within the dashboard component until a patch is available. Restrict access to the dashboard component to minimize the risk of exploitation. Avoid using unsanitized input fields in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-27753

Affected Products

Media Gallery

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-27753 · Security Note
• https://t.me/cvetracker/25513 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930646133547638921 · Twitter Post
• https://twitter.com/CVEnew/status/1930623761453293838 · Twitter Post
• https://rsjoomla.com · Note