{“lastseen”:”2026-02-02T18:37:19″,”description”:”A critical blind SQL injection vulnerability exists in glFusion CMS version 1.3.0, affecting the Media Gallery search functionality. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands and potentially compromise…”,”published”:”2026-02-02T00:00:00″,”modified”:”2026-02-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 glFusion 1.3.0 Blind SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214775″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”glFusion 1.3.0 – Blind SQL Injection\\n Advisory ID: RO-13-001\\n Severity: Critical\\n Vendor: glFusion\\n Product: glFusion CMS\\n Version: 1.3.0\\n \\n \\n Overview #\\n \\n A critical Blind SQL Injection vulnerability exists in glFusion CMS version 1.3.0, affecting the Media Gallery search functionality. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands and potentially compromise the entire database.\\n \\n \\n Vulnerability Details #\\n \\n Affected Versions: 1.3.0 and earlier\\n \\n Location: \/mediagallery\/search.php\\n \\n Affected Parameter: cat_id\\n \\n Root Cause: The vulnerability exists due to insufficient input validation on the cat_id parameter. User-supplied input is directly concatenated into an SQL query without proper sanitization or parameterized queries, allowing attackers to inject malicious SQL statements.\\n \\n \\n Exploitation Requirements #\\n \\n No authentication required\\n Media Gallery module must be enabled\\n Direct access to the search endpoint\\n \\n Impact #\\n \\n Remote attackers can exploit this vulnerability to:\\n \\n Extract sensitive data from the database (usernames, passwords, emails)\\n Bypass authentication mechanisms\\n Modify or delete database content\\n Potentially gain administrative access to the CMS\\n \\n Proof of Concept #\\n \\n POST \/mediagallery\/search.php HTTP\/1.1\\n Host: target.com\\n Content-Type: application\/x-www-form-urlencoded\\n \\n cat_id=’+(SELECT 1 FROM (SELECT SLEEP(25))A)+’\\n \\n Time-based Blind SQL Injection: If the server response is delayed by 25 seconds, the target is vulnerable.\\n \\n \\n Solution #\\n \\n Upgrade to glFusion version 1.3.1 or later, which includes proper input sanitization for the affected parameter.\\n \\n \\n References #\\n \\n Invicti Advisory NS-13-009\\n Exploit-DB 28185\\n Vendor Patch\\n \\n Timeline:\\n \\n [2013-09-05] – First contact\\n [2013-09-06] – Fix released\\n [2013-09-09] – Advisory released\\n \\n Credits: Omar Kurt”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214775″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214775\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-02T18:37:19″,”description”:”A critical blind SQL injection vulnerability exists in glFusion CMS version 1.3.0, affecting the Media Gallery search functionality. The vulnerability allows unauthenticated remote attackers to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-38563","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n