FsPHPGallery Multiple Input Validation Vulnerabilities

BID:11594

Info

FsPHPGallery Multiple Input Validation Vulnerabilities

Bugtraq ID: 11594
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Nov 03 2004 12:00AM
Updated: Nov 03 2004 12:00AM
Credit: The vendor announced these vulnerabilities.
Vulnerable: FsPHPGallery FsPHPGallery 1.1
FsPHPGallery FsPHPGallery 1.0.1
FsPHPGallery FsPHPGallery 0.3.1
FsPHPGallery FsPHPGallery 0.2
Not Vulnerable: FsPHPGallery FsPHPGallery 1.2

Discussion

FsPHPGallery Multiple Input Validation Vulnerabilities

FsPHPGallery is reported prone to multiple input validation vulnerabilities. The following specific issues are reported:

FsPHPGallery is reported prone to a denial of service vulnerability. The issue presents itself due to a failure to sufficiently sanitize user-supplied image size attribute values.

A remote attacker may exploit this vulnerability to deny service for legitimate users.

Additionally FsPHPGallery is reported prone to an information disclosure vulnerability.

A remote attacker may exploit this issue to list contents of arbitrary directories that are readable by the web server process.

Exploit / POC

FsPHPGallery Multiple Input Validation Vulnerabilities

No exploit is required.

Solution / Fix

FsPHPGallery Multiple Input Validation Vulnerabilities

Solution:
The vendor has supplied the following update to address these issues:


FsPHPGallery FsPHPGallery 0.2

FsPHPGallery FsPHPGallery 0.3.1

FsPHPGallery FsPHPGallery 1.0.1

FsPHPGallery FsPHPGallery 1.1

References

FsPHPGallery Multiple Input Validation Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report