Description
SQL injection vulnerability in admin_console/index.asp in Gallery In A Box allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password field. NOTE: these fields might be associated with the txtUsername and txtPassword parameters.
References
- ADV-2007-2798 vdb-entry
- galleryinabox-index-sql-injection(35791) vdb-entry
- 2977 third-party-advisory
- 36284 vdb-entry
- 25194 vdb-entry
- 20070802 [Aria-Security.Net] Gallery In A Box Username & Password Parameters SQL Injection mailing-list
- http://outlaw.aria-security.info/?p=13
- 26334 third-party-advisory