CVE-2019-25523 - Vulnerability Analysis

Overview

XooGallery contains an SQL injection caused by unsanitized input in the cat_id parameter in cat.php, letting unauthenticated attackers bypass authentication, extract or modify database data.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication, extract sensitive data, or modify database contents.

Mitigation

Update to the latest version.

References

• https://www.exploit-db.com/exploits/46609
• https://www.vulncheck.com/advisories/xoogallery-lastest-latest-sql-injection-via-cat-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner