source: http://www.securityfocus.com/bid/17339/info
Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
http://www.example.com/imagegallery/template.php?provided=[SQL]
{"id": "EDB-ID:27543", "hash": "f8a95590bc02915ceee35d68c1ad7e5b", "type": "exploitdb", "bulletinFamily": "exploit", "title": "SoftBiz Image Gallery - template.php provided Parameter SQL Injection", "description": "SoftBiz Image Gallery 0 template.php provided Parameter SQL Injection. CVE-2006-1659 . Webapps exploit for php platform", "published": "2006-03-31T00:00:00", "modified": "2006-03-31T00:00:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/27543/", "reporter": "Linux_Drox", "references": [], "cvelist": ["CVE-2006-1659"], "lastseen": "2016-02-03T06:10:48", "history": [], "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-1659"]}, {"type": "exploitdb", "idList": ["EDB-ID:27545", "EDB-ID:27542", "EDB-ID:27544", "EDB-ID:27546"]}, {"type": "osvdb", "idList": ["OSVDB:24371", "OSVDB:24369", "OSVDB:24368", "OSVDB:24370", "OSVDB:24372"]}], "modified": "2016-02-03T06:10:48"}, "vulnersScore": 7.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/27543/", "sourceData": "source: http://www.securityfocus.com/bid/17339/info\r\n \r\nSoftbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. \r\n \r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nhttp://www.example.com/imagegallery/template.php?provided=[SQL]", "osvdbidlist": ["24369"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}
{"cve": [{"lastseen": "2018-10-19T11:35:58", "bulletinFamily": "NVD", "description": "Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in image_desc.php, (2) provided parameter in template.php, (3) cid parameter in suggest_image.php, (4) img_id parameter in insert_rating.php, and (5) cid parameter in images.php.", "modified": "2018-10-18T12:33:48", "published": "2006-04-07T06:04:00", "id": "CVE-2006-1659", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1659", "title": "CVE-2006-1659", "type": "cve", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-03T06:10:58", "bulletinFamily": "exploit", "description": "SoftBiz Image Gallery 0 suggest_image.php cid Parameter SQL Injection. CVE-2006-1659. Webapps exploit for php platform", "modified": "2006-03-31T00:00:00", "published": "2006-03-31T00:00:00", "id": "EDB-ID:27544", "href": "https://www.exploit-db.com/exploits/27544/", "type": "exploitdb", "title": "SoftBiz Image Gallery - suggest_image.php cid Parameter SQL Injection", "sourceData": "source: http://www.securityfocus.com/bid/17339/info\r\n \r\nSoftbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. \r\n \r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nhttp://www.example.com/imagegallery/suggest_image.php?cid=[SQL]", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27544/"}, {"lastseen": "2016-02-03T06:11:16", "bulletinFamily": "exploit", "description": "SoftBiz Image Gallery 0 images.php cid Parameter SQL Injection. CVE-2006-1659. Webapps exploit for php platform", "modified": "2006-03-31T00:00:00", "published": "2006-03-31T00:00:00", "id": "EDB-ID:27546", "href": "https://www.exploit-db.com/exploits/27546/", "type": "exploitdb", "title": "SoftBiz Image Gallery - images.php cid Parameter SQL Injection", "sourceData": "source: http://www.securityfocus.com/bid/17339/info\r\n \r\nSoftbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. \r\n \r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nhttp://www.example.com/imagegallery/images.php?cid=[SQL]", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27546/"}, {"lastseen": "2016-02-03T06:11:07", "bulletinFamily": "exploit", "description": "SoftBiz Image Gallery 0 insert_rating.php img_id Parameter SQL Injection. CVE-2006-1659. Webapps exploit for php platform", "modified": "2006-03-31T00:00:00", "published": "2006-03-31T00:00:00", "id": "EDB-ID:27545", "href": "https://www.exploit-db.com/exploits/27545/", "type": "exploitdb", "title": "SoftBiz Image Gallery - insert_rating.php img_id Parameter SQL Injection", "sourceData": "source: http://www.securityfocus.com/bid/17339/info\r\n \r\nSoftbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. \r\n \r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nhttp://www.example.com/imagegallery/insert_rating.php?img_id=[sql]", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27545/"}, {"lastseen": "2016-02-03T06:10:39", "bulletinFamily": "exploit", "description": "SoftBiz Image Gallery 0 mage_desc.php Multiple Parameter SQL Injection. CVE-2006-1659. Webapps exploit for php platform", "modified": "2006-03-31T00:00:00", "published": "2006-03-31T00:00:00", "id": "EDB-ID:27542", "href": "https://www.exploit-db.com/exploits/27542/", "type": "exploitdb", "title": "SoftBiz Image Gallery - mage_desc.php Multiple Parameter SQL Injection", "sourceData": "source: http://www.securityfocus.com/bid/17339/info\r\n\r\nSoftbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. \r\n\r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nhttp://www.example.com/imagegallery/image_desc.php?id=[SQL]", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27542/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:21", "bulletinFamily": "software", "description": "## Vulnerability Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the template.php script not properly sanitizing user-supplied input to the 'provided' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the template.php script not properly sanitizing user-supplied input to the 'provided' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\nhttp://[target]/imagegallery/template.php?provided=[SQL]\n## References:\nVendor URL: http://www.softbizscripts.com/\n[Secunia Advisory ID:19523](https://secuniaresearch.flexerasoftware.com/advisories/19523/)\n[Related OSVDB ID: 24371](https://vulners.com/osvdb/OSVDB:24371)\n[Related OSVDB ID: 24368](https://vulners.com/osvdb/OSVDB:24368)\n[Related OSVDB ID: 24370](https://vulners.com/osvdb/OSVDB:24370)\n[Related OSVDB ID: 24372](https://vulners.com/osvdb/OSVDB:24372)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0033.html\n[CVE-2006-1659](https://vulners.com/cve/CVE-2006-1659)\nBugtraq ID: 17339\n", "modified": "2006-03-31T05:17:36", "published": "2006-03-31T05:17:36", "href": "https://vulners.com/osvdb/OSVDB:24369", "id": "OSVDB:24369", "type": "osvdb", "title": "Softbiz Image Gallery template.php provided Variable SQL Injection", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:21", "bulletinFamily": "software", "description": "## Vulnerability Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the insert_rating.php script not properly sanitizing user-supplied input to the 'img_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the insert_rating.php script not properly sanitizing user-supplied input to the 'img_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\nhttp://[target]/imagegallery/insert_rating.php?img_id=[sql]\n## References:\nVendor URL: http://www.softbizscripts.com/\n[Secunia Advisory ID:19523](https://secuniaresearch.flexerasoftware.com/advisories/19523/)\n[Related OSVDB ID: 24368](https://vulners.com/osvdb/OSVDB:24368)\n[Related OSVDB ID: 24369](https://vulners.com/osvdb/OSVDB:24369)\n[Related OSVDB ID: 24370](https://vulners.com/osvdb/OSVDB:24370)\n[Related OSVDB ID: 24372](https://vulners.com/osvdb/OSVDB:24372)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0033.html\nFrSIRT Advisory: ADV-2006-1217\n[CVE-2006-1659](https://vulners.com/cve/CVE-2006-1659)\nBugtraq ID: 17339\n", "modified": "2006-03-31T05:17:36", "published": "2006-03-31T05:17:36", "href": "https://vulners.com/osvdb/OSVDB:24371", "id": "OSVDB:24371", "type": "osvdb", "title": "Softbiz Image Gallery insert_rating.php img_id Variable SQL Injection", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:21", "bulletinFamily": "software", "description": "## Vulnerability Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the images.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the images.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\nhttp://[target]/imagegallery/images.php?cid=[SQL]\n## References:\nVendor URL: http://www.softbizscripts.com/\n[Secunia Advisory ID:19523](https://secuniaresearch.flexerasoftware.com/advisories/19523/)\n[Related OSVDB ID: 24371](https://vulners.com/osvdb/OSVDB:24371)\n[Related OSVDB ID: 24368](https://vulners.com/osvdb/OSVDB:24368)\n[Related OSVDB ID: 24369](https://vulners.com/osvdb/OSVDB:24369)\n[Related OSVDB ID: 24370](https://vulners.com/osvdb/OSVDB:24370)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0033.html\nFrSIRT Advisory: ADV-2006-1217\n[CVE-2006-1659](https://vulners.com/cve/CVE-2006-1659)\nBugtraq ID: 17339\n", "modified": "2006-03-31T05:17:36", "published": "2006-03-31T05:17:36", "href": "https://vulners.com/osvdb/OSVDB:24372", "id": "OSVDB:24372", "type": "osvdb", "title": "Softbiz Image Gallery images.php cid Variable SQL Injection", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:21", "bulletinFamily": "software", "description": "## Vulnerability Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the image_desc.php script not properly sanitizing user-supplied input to the 'id' or 'msg' variables. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the image_desc.php script not properly sanitizing user-supplied input to the 'id' or 'msg' variables. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\nhttp://[target]/imagegallery/image_desc.php?id=[SQL]\n## References:\nVendor URL: http://www.softbizscripts.com/\n[Secunia Advisory ID:19523](https://secuniaresearch.flexerasoftware.com/advisories/19523/)\n[Related OSVDB ID: 24371](https://vulners.com/osvdb/OSVDB:24371)\n[Related OSVDB ID: 24369](https://vulners.com/osvdb/OSVDB:24369)\n[Related OSVDB ID: 24370](https://vulners.com/osvdb/OSVDB:24370)\n[Related OSVDB ID: 24372](https://vulners.com/osvdb/OSVDB:24372)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0033.html\nFrSIRT Advisory: ADV-2006-1217\n[CVE-2006-1659](https://vulners.com/cve/CVE-2006-1659)\nBugtraq ID: 17339\n", "modified": "2006-03-31T05:17:36", "published": "2006-03-31T05:17:36", "href": "https://vulners.com/osvdb/OSVDB:24368", "id": "OSVDB:24368", "type": "osvdb", "title": "Softbiz Image Gallery image_desc.php Multiple Variable SQL Injection", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:21", "bulletinFamily": "software", "description": "## Vulnerability Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the suggest_image.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nSoftbiz Image Gallery contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the suggest_image.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\nhttp://[target]/imagegallery/suggest_image.php?cid=[SQL]\n## References:\nVendor URL: http://www.softbizscripts.com/\n[Secunia Advisory ID:19523](https://secuniaresearch.flexerasoftware.com/advisories/19523/)\n[Related OSVDB ID: 24371](https://vulners.com/osvdb/OSVDB:24371)\n[Related OSVDB ID: 24368](https://vulners.com/osvdb/OSVDB:24368)\n[Related OSVDB ID: 24369](https://vulners.com/osvdb/OSVDB:24369)\n[Related OSVDB ID: 24372](https://vulners.com/osvdb/OSVDB:24372)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0033.html\nFrSIRT Advisory: ADV-2006-1217\n[CVE-2006-1659](https://vulners.com/cve/CVE-2006-1659)\nBugtraq ID: 17339\n", "modified": "2006-03-31T05:17:36", "published": "2006-03-31T05:17:36", "href": "https://vulners.com/osvdb/OSVDB:24370", "id": "OSVDB:24370", "type": "osvdb", "title": "Softbiz Image Gallery suggest_image.php cid Variable SQL Injection", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}]}
