Gallery Bank <= 3.0.101 - SQL Injection



Description
The Gallery Bank – Responsive Photo Gallery plugin exposes a Short Code named ‘gallery_bank’, in order to allow site publishers to insert galleries into pages / posts. This Short Code is vulnerable to a UNION based SQL Injection. This is possible by manipulating the field ‘show_albums’ when using this short code. This could allow any user who has access to edit, or publish pages or posts on a site to execute arbitrary SQL, and retrieve the output from such queries.

While it could be said that if a user has access to edit or publish pages or posts on a WordPress site, this vulnerability would be the least of your worries, however it’s quite possible to restrict users access to such an extent that their editor level access would grant them very little to no exploitable privileges.

Affects Plugin

fixed in version 3.0.102

References

URL https://research.g0blin.co.uk/g0blin-00033/
URL https://wordpress.org/plugins/gallery-bank/

Classification

Type SQLI
OWASP Top 10 A1: Injection
CWE CWE-89

Miscellaneous

Submitter James Hooker
Submitter Website https://research.g0blin.co.uk
Submitter Twitter g0blinResearch
Views 4153
Verified No
WPVDB ID 7804

Timeline

Publicly Published 2015-02-21 (over 4 years ago)
Added 2015-02-23 (over 4 years ago)
Last Updated 2015-05-15 (over 4 years ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin