WordPress Plugin Vulnerabilities
Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
Description
SQL injection in the Photo Gallery (10Web Photo Gallery) plugin before 1.5.55 exists via the frontend/models/model.php bwg_search_x parameter.
Impact
All gallery_type is affected by this bug and any unauthenticated remote attacker can exploit the plugin.
Proof of Concept
Affects Plugins
Fixed in 1.5.55 References
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Submitter
Nguyen Anh Tien
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-05-15 (about 5 years ago)
Added
2020-05-15 (about 5 years ago)
Last Updated
2021-01-22 (about 4 years ago)
WPScan 