CVE-2005-4228 - CVE House

Back to Database

Status published High CVE-2005-4228

Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier allow...

7.5 CVSS

Vulnerability Description

Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) since, (2) sort_by, and (3) items_number parameters to comments.php, (4) the search parameter to category.php, and (5) image_id parameter to picture.php. NOTE: it was later reported that the comments.php/sort_by vector also affects 1.7.2 and earlier.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-4228

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from phpwebgallery

View All →

Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers...

plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators...

Multiple cross-site scripting (XSS) vulnerabilities in admin/include/isadmin.inc.php in PhpWebGallery 1.3.4...

PhpWebGallery 1.7.0 and 1.7.1 allows remote authenticated users with advisor...

Cross-site scripting (XSS) vulnerability in picture.php in PhpWebGallery 1.7.0, when...

Affected Vendor

phpwebgallery

View all reports →

Affected Software

phpwebgallery

Vulnerable Versions:

0, 1.0, 1.1, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.6, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1

Timeline

Official Publish: December 14th, 2005

Last Modified: August 7th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.