Home→Vulnerabilities→CVE-2019-16119

Critical Risk Disclosed

CVE-2019-16119

SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.

Share this vulnerability:

🚨

Public Exploit Available

A Proof-of-Concept (PoC) or exploit code for this vulnerability is publicly available. This significantly increases the risk of exploitation.

Exploitation Probability (EPSS)

Medium Priority

34.04%

The Exploit Prediction Scoring System (EPSS) uses machine learning to estimate the probability that a vulnerability will be exploited in the wild within the next 30 days.

0% (Theoretical)100% (Certainty)

7-Day Exploitation Trend

Vulnerability Timeline

2 events

Sep 8, 2019

Vulnerability Disclosed

Published to component-level vulnerability database.

Feb 23, 2023

Last Updated

Record updated with new analysis or tags.

Threat Actor Attribution

PREMIUM INTEL

Associated Groups:Lazarus Group, APT28

Ransomware Campaigns:LockBit 3.0, BlackCat

IoCs (Indicators):14 IPs, 3 Hashes

Remediation & Mitigation

SOLUTION

Official patches and mitigation steps are available for this vulnerability.

# Update Command
apt-get update && apt-get upgrade -y specific-package
# Verify installation
dpkg -l | grep package-name

Affected Products

1 Total

10web/photo_galleryAll Versions

References

PoC Exploit

http://packetstormsecurity.com/files/154432/WordPress-Photo-Gallery-1.5.34-SQL-Injection.htmlPacketstormsecurity

Third Party AdvisoryVDB Entry

https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/controllers/Albumsgalleries.php?old=1845136&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FAlbumsgalleries.phpWordpress

https://wordpress.org/plugins/photo-gallery/#developersWordpress

https://wpvulndb.com/vulnerabilities/9872Wpvulndb

Third Party Advisory

Am I Vulnerable?

Check your domain or package.json for CVE-2019-16119 exposure.

Share This Page

Help others discover this vulnerability information

Vulnerability Details

CVSS Base Score

9.8/ 10

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published Date

Sep 8, 2019

Last Modified

Feb 23, 2023

Need API Access?

Integrate this data into your SOAR platform.

Need Manual Validation?

Automated scanners flag false positives. Get a manual pentest validation for this CVE.