4images 1.7.X: SQL Injection and Path Disclosure Vulnerabilities

Users of 4images 1.7.X please be advised of a SQL injection and path disclosure vulnerabilities that has been identified.

To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

Amplify’d from www.criticalwatch.com

EV0200: [EV0200] SQL injection and Path Disclosure Auth Bypass in 4images 1.7.X

Software: "Powered by 4images"

Type: SQL injection and Path Disclosure

--------Description-------- bug exists in categories.php script. Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/xxx/html/hootersflorida/includes/db_mysql.php on line 116 Read more at www.criticalwatch.com

 

See this Amp at http://bit.ly/h2ZpId