CVE-2014-7153 Image Gallery - Responsive Photo Gallery <= 1.0.7 - SQL Injection

MediumCVSS 6.5 EPSS 2.3% Public exploit

Published: 2014-09-22 17:00
Updated: 2026-06-17 03:14
Exploit status: Public exploit available

Description

SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php.

Affected products

Product	Affected versions	Fixed in
huge-it image gallery	= 1.0.1	No fix listed
wordpress gallery-images(WordPress)	< 1.0.8	1.0.8

References

packetstormsecurity.com exploit
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v2.0

6.5 Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: Single
Confidentiality: Partial
Integrity: Partial
Availability: Partial

All scores (2)

v3.1 8.8 · wordfence
v2.0 6.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.29% (percentile 83.5)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

WordPress Plugin Huge-IT Image Gallery 1.0.1 - (Authenticated) SQL Injection Exploit · Exploit Database (OffSec) · 2014-09-02