PT-2006-2661 · Eric Gerdes · Crafty Syntax Image Gallery

Name of the Vulnerable Software and Affected Versions: Eric Gerdes Crafty Syntax Image Gallery CSIG versions 3.1g and earlier Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the limitquery s parameter when the $projectid variable is...