CVE-2012-2338 SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to execute arbitrary SQL commands via the id_adh parameter to pic...
HighCVSS 7.5
EPSS 2.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to execute arbitrary SQL commands via the id_adh parameter to picture.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| johan cwiklinski galette | = 0.63 | No fix listed |
| johan cwiklinski galette | = 0.63-rc1 | No fix listed |
| johan cwiklinski galette | = 0.63.1 | No fix listed |
| johan cwiklinski galette | = 0.63.2 | No fix listed |
| johan cwiklinski galette | = 0.63.3 | No fix listed |
References
- redmine.ulysses.fr exploit
- redmine.ulysses.fr
- [oss-security] 20120510 CVE-request: galette sql injection mailing-list
- [oss-security] 20120510 Re: CVE-request: galette sql injection mailing-list
- 53463 exploit vdb-entry