bugtraq - Invision Gallery 2.0.6 ( SQL Injection )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 2 May 2006 14:35:56 -0000
From: o.y.6@...mail.com
To: bugtraq@...urityfocus.com
Subject: Invision Gallery  2.0.6 ( SQL Injection )


[left]
Invision Gallery  2.0.6 ( SQL Injection )

	File   :- modules/gallery/post.php
	Line   :- 943
    Bug By :- Devil-00

    	* Welcome Back ( Security4arab ) *

            Arabian Security WebSites

            	www.s4a.cc
                www.securitygurus.net

[php]
$this->ipsclass->DB->simple_construct( array( 'select' => 'COUNT(*) AS total', 'from' => 'gallery_images', 'where' => "album_id={$this->ipsclass->input['album']}" ) );
[/php]

    $this->ipsclass->input['album'] = Unfilter Input

    Exploit :-

    	Post New Image Then Edit POST Requset By HTTPLiveHeader

        	album=[SQL]

Fix :-

[php]
$this->ipsclass->DB->simple_construct( array( 'select' => 'COUNT(*) AS total', 'from' => 'gallery_images', 'where' => "album_id={".intval($this->ipsclass->input['album'])."}" ) );
[/php]
[/left]