ClickGallery Server--SQl iNjection Vulnerabilty

vendor:

ClickGallery Server

by:

..::[ SONiC ]::.. aka ~the_pshyco~

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: ClickGallery Server

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

ClickGallery Server–SQl iNjection Vulnerabilty

ClickGallery Server is a full featured online image gallery application. It supports multiple user accounts with the ability to have public/private galleries. An attacker can exploit a SQL injection vulnerability in the application by sending malicious SQL queries to the server via the 'currentpage' parameter in the 'gallery.asp' page.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query.

Source

Exploit-DB raw data:

==============================================================
ClickGallery Server--SQl iNjection  Vulnerabilty 
==============================================================


Name : ClickGallery Server--SQl iNjection  Vulnerabilty 
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :   http://www.clickgallery.net/



Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 
###################################
I'm SONiC member from Inj3ct0r Team
################################### 

Description:

ClickGallery Server is a full featured online image gallery application. It supports multiple user accounts with the ability to have public/private galleries.

#######################################################################################################
eXploit :SQL injection  Vulnerabilty 

DEMO URL  http://www.site.net/gallery.asp?currentpage=1 [SqLi]



###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco