CVE-2009-1799: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the getGalleryImage function in stadmin/galleryoutput.php in ST-Gallery 0.1 alpha, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 gallerycategory or 2 galleryshow parameter to example.php...