Gallarific Multiple Vulnerabilities

vendor:

Gallarific

by:

SecurityFocus

7.5

CVSS

HIGH

Cross-site Scripting and Authentication-Bypass

79, 287, 522

CWE

Product Name: Gallarific

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: All

2008

Gallarific Multiple Vulnerabilities

Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add new categories, add new users, and modify existing users. Other attacks are also possible.

Mitigation:

Users should upgrade to the latest version of Gallarific. Additionally, users should ensure that all unnecessary features are disabled and that all unnecessary user accounts are removed.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/28163/info
 
Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add new categories, add new users, and modify existing users. Other attacks are also possible.
 
These issues affect both the commercial and the free versions of Gallarific.

http://www.example.com/gallery/gadmin/index.php?task=add  (categori add)
http://www.example.com/gallery/gadmin/users.php?task=edit&id=2 (user edit)
http://www.example.com/gallery/gadmin/users.php?task=add (user add)