vendor:
XooGallery
by:
Ahmet Ümit BAYRAM
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: XooGallery
Affected Version From: Latest
Affected Version To: Latest
Patch Exists: NO
Related CWE: N/A
CPE: a:xooscripts:xoogallery
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Kali Linux
2019
XooGallery – Multiple SQL Injections
XooGallery is vulnerable to multiple SQL Injections. The vulnerable parameters are gal_id, photo_id, cat_id and p. An attacker can exploit these vulnerabilities by sending malicious payloads in the vulnerable parameters. For example, in PoC 1, the payload is gal_id=29' AND 2692=2692 AND 'WCFf'='WCFf
Mitigation:
Input validation should be done to prevent SQL Injection attacks. Sanitizing user input and using prepared statements can also help in mitigating the attack.
