SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   Gallery Vendors:   Gallery Project
Gallery Input Validation Holes Let Remote Users Delete Files and Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1015717
SecurityTracker URL:  http://securitytracker.com/id/1015717
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Mar 3 2006
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   Several vulnerabilities was reported in Gallery. A remote user can inject scripting code. A remote user can delete files on the target system.

The software does not properly filter HTML code from user-supplied input in the X_FORWARDED_FOR HTTP header. A remote user can submit a specially crafted value when adding a comment. When the target user views the comment, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running the Gallery software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A remote user can spoof identities by specifying an arbitrary X_FORWARDED_FOR HTTP header value.

The session handling class _isSessionValid() function does not properly validate user-supplied session ID cookie values. A remote user can supply a specially crafted value to cause the system to delete specified files.

James Bercegay of the GulfTech Security Research Team discovered these vulnerabilities.

The original advisory is available at:

http://www.gulftech.org/?node=research&article_id=00106-03022006

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Gallery software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A remote user can delete files on the target system.

Solution:   The vendor has issued a fixed version (2.0.3), available at:

http://gallery.menalto.com/downloads

Vendor URL:  gallery.menalto.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC