CVE-2015-1055

Vulnerability

The Photo Gallery plugin version 1.2.7 and likely prior versions for WordPress are vulnerable to a blind SQL injection in the order_by parameter when processing a GalleryBox action via wp-admin/admin-ajax.php [1]. The vulnerable endpoint is reachable without authentication. The parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands. The affected plugin has been downloaded nearly 500,000 times [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP GET request to the vulnerable endpoint [1]. The attack requires that at least one gallery exists with at least one image uploaded [1]. The characters < and > are filtered to their HTML entity equivalents, so exploitation typically uses the BETWEEN keyword (e.g., via sqlmap's --tamper=between). The attacker must also determine a valid gallery ID, which can be brute-forced [1]. The injection occurs in the order_by parameter in the request; the full request is sent to /wp-admin/admin-ajax.php with the action=GalleryBox parameter [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the WordPress database backend [1]. This can lead to extraction of sensitive data such as user credentials, posts, and configuration details. The attack is blind (boolean- or time-based), meaning data is retrieved through observable differences in response timing or behavior. The impact is high as it can compromise the entire WordPress instance.

Mitigation

As of the disclosure date (January 2015), the vulnerability has not been patched in the public version 1.2.7 or earlier [1]. Users should upgrade to a fixed version if and when it becomes available. No workaround is provided in the reference. If the plugin is no longer maintained, consider disabling or removing it.