CVE-2005-4228
phpwebgallery < 1.7.2 - SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-4228. PoCs published by r0t3d3Vil.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in PhpWebGallery, where the 'image_id' parameter in 'picture.php' is not properly sanitized. It lacks actual exploit code but outlines the vulnerability and potential impact.
Description
Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) since, (2) sort_by, and (3) items_number parameters to comments.php, (4) the search parameter to category.php, and (5) image_id parameter to picture.php. NOTE: it was later reported that the comments.php/sort_by vector also affects 1.7.2 and earlier.
Exploits (3)
The provided text describes a SQL injection vulnerability in PhpWebGallery, where the 'image_id' parameter in 'picture.php' is not properly sanitized. It lacks actual exploit code but outlines the vulnerability and potential impact.
The provided text describes SQL injection vulnerabilities in PhpWebGallery, detailing vulnerable parameters in the comments.php file. It includes example URLs demonstrating how an attacker could inject malicious SQL queries.
This is a writeup describing SQL injection vulnerabilities in PhpWebGallery. It provides a URL example demonstrating how an attacker can inject SQL queries via the 'search' parameter.