CVE-2017-1002012
📋 TL;DR
This vulnerability allows SQL injection attacks in the WordPress Image Gallery with Slideshow plugin. Attackers can exploit unsanitized 'gid' parameter input in admin_setting.php to execute arbitrary SQL commands. All WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- WordPress Image Gallery with Slideshow plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, or site takeover
Likely Case
Database information disclosure, data manipulation, or authentication bypass
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Exploitation requires admin access to the WordPress dashboard
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.5.3 or later
Vendor Advisory: https://wordpress.org/plugins/image-gallery-with-slideshow/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Image Gallery with Slideshow'
4. Click 'Update Now' if update available
5. If no update, deactivate and delete plugin
6. Install latest version from WordPress repository
🔧 Temporary Workarounds
Input Sanitization Filter
allAdd input validation for gid parameter before SQL execution
Modify admin_setting.php to sanitize $_GET['gid'] using intval() or prepare statements
Access Restriction
linuxRestrict access to admin_setting.php endpoint
Add .htaccess rules to block direct access to admin_setting.php
🧯 If You Can't Patch
- Deactivate and remove the vulnerable plugin immediately
- Implement web application firewall rules to block SQL injection patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Image Gallery with Slideshow → Version. If version is 1.5.2 or earlier, you are vulnerable.Check Version:
wp plugin list --name='image-gallery-with-slideshow' --field=versionVerify Fix Applied:
After update, verify plugin version is 1.5.3 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Unexpected database schema changes
Network Indicators:
- HTTP requests with SQL injection patterns in gid parameter
- Unusual outbound database connections
SIEM Query:
source="web_logs" AND (uri="*admin_setting.php*" AND (query="*gid=*'*" OR query="*gid=*%27*" OR query="*gid=*%22*"))