CVE-2008-4338

Brilliant Gallery 5.x-6.x - Authenticated SQL Injection via nid/qid/state/user Parameters

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in the brilliant_gallery_checklist_save function in the bgchecklist/save script in Brilliant Gallery 5.x and 6.x, a module for Drupal, allows remote authenticated users with "access brilliant_gallery" permissions to execute arbitrary SQL commands via the (1) nid, (2) qid, (3) state, and possibly (4) user parameters.

References (7)

Core 7
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32015
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45411
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31387
Various Sources x_refsource_confirm
http://drupal.org/node/313054
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4338
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/496726/100/0/threaded

Scores

EPSS 0.0109
EPSS Percentile 62.1%

Details

CWE
CWE-89
Status published
Products (3)
vacilanda/brilliant_gallery
vacilanda/brilliant_gallery 5
vacilanda/brilliant_gallery 6
Published Sep 30, 2008
Tracked Since Feb 18, 2026