WordPress Plugin Vulnerabilities

Simple Photo Gallery 1.7.8 - Blind SQL Injection

Description

MySQL >= 5.0.12 AND time-based blind (SELECT) sql injection in the gallery_id parameter.

Proof of Concept

Affects Plugins

Plugin icon
simple-photo-gallery
Fixed in 1.8.0

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Submitter
Viktor Gazdag
Submitter twitter
wucpi
Verified
No
WPVDB ID
b29c97db-f202-4cac-8fec-0486e4550a98

Timeline

Publicly Published
2015-05-21 (about 10 years ago)
Added
2015-05-22 (about 10 years ago)
Last Updated
2015-05-22 (about 10 years ago)

Other

Published
Title
Published
2025-12-08
Title
Plugin Organizer < 10.2.4 - Subscriber+ SQLi
Published
2025-02-13
Title
Bit Assist < 1.5.3 - Authenticated (Subscriber+) SQL Injection via id Parameter
Published
2021-03-26
Title
Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode
Published
2025-12-15
Title
Ninja Tables < 5.2.4 - Authenticated (Administrator+) SQL Injection
Published
2025-10-23
Title
MasterStudy LMS < 3.6.28 - Authenticated (Instructor+) SQL Injection