Secunia

_1nf3ct0r_ has reported some vulnerabilities in Invision Gallery, which can be exploited by malicious people to disclose potentially sensitive information and conduct SQL injection attacks.

1) Input passed to the "dir" parameter in index.php is not properly verified before being used in a "readfile()" call. This can be exploited to disclose the content of arbitrary files via directory traversal attacks.

2) Input passed to the "album" parameter in index.php when rating an image is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL commands.

The vulnerabilities are reported in version 2.0.7. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly verified and sanitised.

Provided and/or discovered by
_1nf3ct0r_

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area