Softbiz Image Gallery suggest_image.php cid Variable SQL Injection
Posted on 04 April 2006

Vulnerability Description

Softbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the suggest_image.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.

Manual Testing Notes

http://[target]/imagegallery/suggest_image.php?cid=[SQL]

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products:

• SoftbizScripts.com Image Gallery Unknown or Unspecified Affected

Vulnerability classification:

• Remote vulnerability
• Input manipulation attack
• Impact on confidentiality
• Impact on integrity
• Exploit rumored

External references:

• Secunia Advisory ID: 19523
• Mail List Post: go there
• Vendor URL: go there
• Related OSVDB ID: 24368
• Related OSVDB ID: 24369
• Related OSVDB ID: 24371
• Related OSVDB ID: 24372
• CVE ID: 2006-1659
• Bugtraq ID: 17339
• FrSIRT Advisory: ADV-2006-1217

[ Vulnerabilities main page ]

The HNS Vulnerabilities section is powered by OSVDB

Spotlight

Review: Logging and Log Management

Posted on 22 May 2013.  |  Every security practitioner should be aware of the overwhelming advantages of logging and perusing logs for discovering system intrusions. But logging and log management comes with its own set of difficulties.

Experts highlight top data breach vulnerabilities

Posted on 22 May 2013.  |  Hidden vulnerabilities lie in everyday activities that can expose personal information and lead to data breach, including buying gas with a credit card or wearing a pacemaker.

A closer look at Mega cloud storage

Posted on 21 May 2013.  |  Once a novelty, nowadays many cloud storage services are fighting for their piece of the market in the virtual world. Mega offers 50GB of free space with great pricing on Pro accounts.

The CSO perspective on healthcare security and compliance

Posted on 20 May 2013.  |  Randall Gamby is the CSO of the Medicaid Information Service Center of New York. In this interview he discusses healthcare security and compliance challenges and offers a variety of tips.

Cyber espionage campaign uses professionally-made malware

Posted on 20 May 2013.  |  A massive cyber espionage campaign has been hitting government ministries, IT companies, academic research institutions, and more.