Test ID:	1.3.6.1.4.1.25623.1.0.100000
Category:	Web application abuses
Title:	osCommerce Photo Gallery SQLi Vulnerability
Summary:	Photo Gallery for osCommerce is prone to an SQL injection (SQLi); vulnerability in gallery_process.php.
Description:	Summary: Photo Gallery for osCommerce is prone to an SQL injection (SQLi) vulnerability in gallery_process.php. Vulnerability Insight: Input passed to the parameters in gallery_process.php are not properly sanitised before being used in the SQL queries. Vulnerability Impact: Successful exploitation will allow the attacker to access the whole Database. Affected Software/OS: Photo Gallery <= version 0.6. Solution: Edit gallery_process.php and change all occurrences of $_GET['cID'] to (int)$_GET['cID'] and all occurrences of $_GET['pID'] to (int)$_GET['pID']. Then, at the top of gallery_process php, search for: require('includes/application_top.php') require(DIR_WS_LANGUAGES . $language . '/gallery_user.php') and change to: require('includes/application_top.php') if (!tep_session_is_registered('customer_id')) { tep_redirect(tep_href_link(FILENAME_LOGIN, '', 'SSL')) } require(DIR_WS_LANGUAGES . $language . '/gallery_user.php') CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Copyright	Copyright (C) 2009 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.