4images 1.7.X: SQL Injection and Path Disclosure Vulnerabilities

Users of 4images 1.7.X please be advised of a SQL injection and path disclosure vulnerabilities that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

EV0200: [EV0200] SQL injection and Path Disclosure Auth Bypass in 4images 1.7.X
Software: “Powered by 4images”
Type: SQL injection and Path Disclosure
——–Description——–
bug exists in categories.php
script.
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in
/home/xxx/html/hootersflorida/includes/db_mysql.php on line 116

Read more at http://www.criticalwatch.com

 

Advertisements