Description

WordPress Plugin Gallery-Flagallery Photo Portfolio is prone to an SQL injection vulnerability and an information disclosure vulnerability. Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Gallery-Flagallery Photo Portfolio version 0.59 is vulnerable; other versions may also be affected.

Remediation

Update to plugin version 0.60 or latest

References

http://www.securityfocus.com/bid/46777/exploit

https://www.htbridge.com/advisory/HTB22870

http://www.exploit-db.com/exploits/16947/

http://secunia.com/advisories/43648/

Related Vulnerabilities

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-17899)

ZenCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4567)

WordPress Plugin WP Cerber Security, Anti-spam & Malware Scan Security Bypass (9.0)

WordPress Plugin WP Statistics SQL Injection (9.4)

Claroline Other Vulnerability (CVE-2005-1375)

Severity

High

Classification

CWE-22 CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure SQL Injection