Gmedia Photo Gallery

Gmedia Photo Gallery's mobile-app library action passes unauthenticated gmedia__in input into a vulnerable database query, permitting time-based SQL injection and data extraction. The handler does not enforce its feature flag or nonce. Disabling the Mobile App option alone does not remove the disclosed exposure. Published affected versions: <= 1.25.1.

An unauthenticated attacker can supply input that changes database-query semantics and permits inference of database contents through blind SQL injection. No victim interaction is required. The export does not identify the endpoint, parameter, vulnerable query or inference channel. The CNA vector reports high confidentiality and limited availability impact, without a database-write claim. Affected versions: <= 1.25.1. No fixed release is confirmed by this archive; the official changelog lookup could not be completed.

Gmedia Photo Gallery is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Gmedia Photo Gallery is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.