Description
SQL injection vulnerability in portfolio_photo_popup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the count_click function in includes/functions/fns_std.php. NOTE: this issue could produce resultant XSS.
References
- ADV-2006-1533 vdb-entry
- 24987 vdb-entry
- 20060427 Instant Photo Gallery <= Multiple XSS (fwd) mailing-list
- 24986 vdb-entry
- 17696 vdb-entry
- 19813 third-party-advisory
- 803 third-party-advisory
- 20060427 Re: Instant Photo Gallery <= Multiple XSS mailing-list
- 20060425 Instant Photo Gallery <= Multiple XSS mailing-list