2BGal disp_album.php id_album Parameter SQL Injection

The remote host appears to be running 2BGal, a photo gallery software written in PHP. There is a flaw in the 'dispalbum.php' script which fails to sanitize input to the 'idalbum' field. This may allow anyone to inject arbitrary SQL commands. An attacker could exploit this to obtain sensitive...