Gallery Bank <= 3.0.101 - SQL Injection

Sign up to our free email alerts service for instant vulnerability notifications!

Description
The Gallery Bank – Responsive Photo Gallery plugin exposes a Short Code named ‘gallery_bank’, in order to allow site publishers to insert galleries into pages / posts. This Short Code is vulnerable to a UNION based SQL Injection. This is possible by manipulating the field ‘show_albums’ when using this short code. This could allow any user who has access to edit, or publish pages or posts on a site to execute arbitrary SQL, and retrieve the output from such queries.

While it could be said that if a user has access to edit or publish pages or posts on a WordPress site, this vulnerability would be the least of your worries, however it’s quite possible to restrict users access to such an extent that their editor level access would grant them very little to no exploitable privileges.

Affects

Plugin gallery-bank
fixed in version 3.0.102

References

URL https://research.g0blin.co.uk/g0blin-00033/
URL https://wordpress.org/plugins/gallery-bank/

Classification

Type SQLI
OWASP Top 10 A1: Injection
CWE CWE-89

Miscellaneous

Submitter James Hooker
Submitter Website https://research.g0blin.co.uk
Submitter Twitter g0blinResearch
Views 188
Verified No
WPVDB ID 7804

Timeline

Publicly Published 2015-02-21 (almost 2 years ago)
Added 2015-02-23 (almost 2 years ago)
Last Updated 2015-05-15 (over 1 year ago)

Copyright & License

Copyright All data and resources contained within this page and this web site is Copyright © The WPScan Team.
License Some of this data may be used for non-commercial purposes, however, any potential commercial usage of this data will require a license. If you would like to inquire about a commercial license please contact us.