Gallery Bank <= 3.0.101 - SQL InjectionSign up to our free email alerts service for instant vulnerability notifications!
The Gallery Bank – Responsive Photo Gallery plugin exposes a Short Code named ‘gallery_bank’, in order to allow site publishers to insert galleries into pages / posts. This Short Code is vulnerable to a UNION based SQL Injection. This is possible by manipulating the field ‘show_albums’ when using this short code. This could allow any user who has access to edit, or publish pages or posts on a site to execute arbitrary SQL, and retrieve the output from such queries. While it could be said that if a user has access to edit or publish pages or posts on a WordPress site, this vulnerability would be the least of your worries, however it’s quite possible to restrict users access to such an extent that their editor level access would grant them very little to no exploitable privileges.
fixed in version 3.0.102
|OWASP Top 10||A1: Injection|
|Publicly Published||2015-02-21 (about 2 years ago)|
|Added||2015-02-23 (about 2 years ago)|
|Last Updated||2015-05-15 (almost 2 years ago)|
Copyright & License
|Copyright||All data and resources contained within this page and this web site is Copyright © The WPScan Team.|
|License||Some of this data may be used for non-commercial purposes, however, any potential commercial usage of this data will require a license. If you would like to inquire about a commercial license please contact us.|