Description
A SQL injection vulnerability exists in FaScript FaPhoto version 1 through the show.php script. The id parameter is not properly sanitized before being used in database queries.
Impact
Attackers can inject arbitrary SQL commands to extract, modify, or delete data from the database, potentially accessing all photo metadata and administrative credentials.
Solution
Apply parameterized queries to the id parameter in show.php. Upgrade to a maintained photo gallery script.