Secunia

JeiAr has reported some vulnerabilities in Invision Gallery!, allowing malicious people to conduct SQL injection attacks.

The problem is that input passed to several parameters including "img", "cat", "sort_key", "order_key", "user", and "album" in "index.php" isn't properly verified before it is used in SQL queries. This can potentially be exploited to manipulate SQL queries or extract data.

The vulnerabilities have been reported in version 1.0.1. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly validated.

Provided and/or discovered by
JeiAr of the GulfTech Security Research Team

Changelog
Further details available in Customer Area

Original Advisory
http://www.gulftech.org/03222004.php

Deep Links
Links available in Customer Area