high7.5Public exploit code
CVE-2006-5206
SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Invision Gallery 2.0.7 - 'readfile()' / SQL Injection2006-10-03 · webapps · php · Verified
Impact
SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2) forum/index.php, when the rate command in the gallery automodule is used.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Invision Power Services | Invision Gallery | through 2.0.7 Versions 1.0.1, 1.3, 1.3.1, 2.0.3, 2.0.6 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/22400
- http://www.securityfocus.com/bid/20327
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29333
- https://www.exploit-db.com/exploits/2473
- http://secunia.com/advisories/22400
- http://www.securityfocus.com/bid/20327
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29333
- https://www.exploit-db.com/exploits/2473