Unscored CVE-2015-1055 EUVD-2015-1198GHSA-g27q-hphj-9pm4

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via t…

Published Jan 16, 2015 · Updated Sep 16, 2024 · Assigned by mitre

Description

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.

References

72015 vdb-entry
20150112 Wordpress Photo Gallery 1.2.7 unauthenticated SQL injection mailing-list