Joomla Component JE Photo Gallery SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Joomla Component JE Photo Gallery version 1.1. This vulnerability allows unauthenticated attackers to manipulate SQL queries by injecting malicious code through the 'categoryid' parameter. Exploitation of this vulnerability enables attackers to execute arbitrary SQL queries, potentially leading to the extraction of sensitive database information such as usernames and password hashes.

Impact

Successful exploitation allows for arbitrary SQL query execution, enabling attackers to access sensitive database information.

Reproduction

To reproduce this vulnerability, send a GET request to 'index.php' with the 'categoryid' parameter crafted to include malicious SQL code. The injection can be used to execute SQL commands that, for example, extract data from the 'users' table.