CVE-2008-6485

SoftComplex PHP Image Gallery - SQL Injection via ctg Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2008-6485. PoCs published by Hussin X.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in SoftComplex PHP Image Gallery by manipulating the 'ctg' parameter to extract user credentials (login and password) from the database. The payload uses a UNION-based SQL injection to concatenate and display sensitive data.

Description

SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery allows remote attackers to execute arbitrary SQL commands via the ctg parameter.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Hussin X · textwebappsphp
https://www.exploit-db.com/exploits/7026

This exploit demonstrates a SQL injection vulnerability in SoftComplex PHP Image Gallery by manipulating the 'ctg' parameter to extract user credentials (login and password) from the database. The payload uses a UNION-based SQL injection to concatenate and display sensitive data.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: SoftComplex PHP Image Gallery (version unspecified)
No auth needed
Prerequisites: Target application must be running a vulnerable version of SoftComplex PHP Image Gallery · The 'user' table must exist with 'login' and 'password' columns
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
webappsphp
https://www.exploit-db.com/exploits/7021

This exploit demonstrates an authentication bypass and SQL injection vulnerability in Softcomplex PHP Image Gallery v1.0. It provides a simple bypass method using a crafted username ('admin ' or ' 1=1') to gain unauthorized admin access.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Softcomplex PHP Image Gallery v1.0
No auth needed
Prerequisites: Access to the login page of the target application
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32182
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46436
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7026

Scores

EPSS 0.0097
EPSS Percentile 57.4%

Details

CWE
CWE-89
Status published
Products (1)
softcomplex/php_image_gallery
Published Mar 18, 2009
Tracked Since Feb 18, 2026