Fedek-Xbow

**Name of the Vulnerable Software and Affected Versions** Photoview versions prior to 2.4.1 **Description** An SQL injection issue exists in the album download route. Unauthenticated attackers can inject SQL by manipulating the `album id` path segment. By supplying crafted SQL expressions in the `album id` parameter, attackers can extract arbitrary data from the database using time-based or blind injection techniques. Time-based injection is a method where the attacker sends a query that forces the database to wait a specific amount of time before responding if a condition is true, while blind injection involves asking the database true/false questions to infer data. **Recommendations** Update Photoview to a version newer than 2.4.0. Avoid using the `album id` parameter in the album download route until the issue is resolved.