CVE:CVE-2009-1799
CNNVD:CNNVD-200905-317
ST-Gallery是图片库管理程序。
ST-Gallery 0.1 alpha的st_admin/gallery_output.php的getGalleryImage函数中存在多个SQL注入漏洞,当magic_quotes_gpc被中止时,远程攻击者可以借助(1)gallery_category或(2)对example.php的gallery_show参数，执行任意SQL指令。
solution:Upgrade sebastian-thiele st-gallery to a higher version than 0.1_alpha,and avoid the version 0.1_alpha