header-logo
Suggest Exploit
vendor:
Invision Power Board Gallery
by:
Ashiyane Digital Security Team
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Invision Power Board Gallery
Affected Version From: 2.0.5
Affected Version To: 2.0.5
Patch Exists: N/A
Related CWE: N/A
CPE: a:invision_power_services:invision_power_board_gallery
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2013

Invision Gallery SQL Injection

Invision Gallery version 2.0.5 is vulnerable to SQL Injection. An attacker can inject malicious SQL queries via the 'img' parameter in the 'site/index.php?automodule=gallery&cmd=si&img=[SQL]' or 'site/act=module&module=gallery&cmd=si&img=[SQL]' URL. This can be exploited to bypass authentication, access, modify or delete data from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Sanitize all user input and escape special characters.
Source

Exploit-DB raw data:

##############
# Exploit Title : Invision Gallery SQL Injection
#
# Exploit Author : Ashiyane Digital Security Team
#
# software Homepage: www.invisionpower.com/apps/gallery/
#
# Home : ww.Ashiyane.org
#
# Security Risk : High - SQL Injection
#
# version : 2.0.5
#
# Dork : Invision Gallery 2.0.5 © 2013  IPS, Inc.   inurl:img=  or Invision Gallery 2.0.5  IPS, Inc.   inurl:img=
#
##############
#location: site/index.php?automodule=gallery&cmd=si&img=[SQL]
#  or site/act=module&module=gallery&cmd=si&img=[SQL]  
#
##############
# [Inject with Havij or inject manually]
##############
#Greetz to: My Lord ALLAH
##############
#
#Amirh03in
#
##############

Navigation

Suggest Exploit

Services By CQR