CVE-2008-6789

Vulnerability

MindDezign Photo Gallery version 2.2 contains a SQL injection vulnerability in the login action of the admin module. The username parameter is not properly sanitized before being used in SQL queries. The vulnerability is exploitable when PHP's magic_quotes_gpc is disabled [1].

Exploitation

An unauthenticated attacker can send a crafted HTTP POST request to index.php?module=admin&action=login with a malicious username parameter containing SQL injection payloads. The provided exploit script demonstrates how to inject SQL statements that insert a new administrator user into the database, bypassing authentication [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands, leading to the creation of an administrative account. This grants full control over the gallery application, including the ability to modify, delete, or exfiltrate data.

Mitigation

No official patch has been released for this vulnerability. The application may be end-of-life. Users should disable the admin module or apply input validation and parameterized queries. Disabling magic_quotes_gpc is not recommended as a security measure.