[38340] in bugtraq
zOOM Media Gallery - Simple SQL Injection discovery
daemon@ATHENA.MIT.EDU (Andreas Constantinides)
Wed Apr 13 10:03:35 2005
Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Wed, 13 Apr 2005 08:02:12 +0300
Message-ID: <C9D9636D25E0C34991E792F51CAB84E93861FD@ithaki.odysseyconsultants.com>
From: "Andreas Constantinides" <aconstantinides@OdysseyConsultants.com>
To: <bugtraq@securityfocus.com>
Content-Transfer-Encoding: 8bit
Description:
zOOm Media Gallery (http://zoom.ummagumma.nl) is a php/sql component+module for MamboCMS and is in use by many sites of the internet.
I discover a simple SQL Injection in it.
Affected Versions:
zOOm Image Gallery 2.1.2, *
POC:
It is possible to proof my concept using the original site of zOOM:
http://www.example.com/index.php?option=com_zoom&Itemid=39&catid=2+OR+1=1
the above url can show all images in all categories of images of the zOOM gallery database but other commands are also possible that can result in a database owning.
Andreas Constantinides
www.megahz.org
www.odysseyconsultants.com
