My Image Gallery Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	14570
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2005 12:00AM
Updated:	Aug 16 2005 12:00AM
Credit:	The discoverer of this vulnerability is unknown.
Vulnerable:	My Image Gallery My Image Gallery 1.4.1
Not Vulnerable:	My Image Gallery My Image Gallery 1.50

My Image Gallery Multiple Cross Site Scripting Vulnerabilities

My Image Gallery is prone to multiple cross-site scripting vulnerabilities due to improper sanitization of user-supplied input.

An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials. Other attacks are also possible.

My Image Gallery Multiple Cross Site Scripting Vulnerabilities

No exploit is required.

Examples have been provided:

http://www.example.com/[path]/index.php?currDir=./<script>alert(document.cookie)</script>
http://www.example.com/index.php?currDir=./test&pageType=image&image=<script>alert(document.cookie)</script>

My Image Gallery Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released version 1.50 to resolve this issue.


My Image Gallery My Image Gallery 1.4.1

• My Image Gallery mig-1.5.0.tar.gz
  http://prdownloads.sourceforge.net/mig/mig-1.5.0.tar.gz?download

My Image Gallery Multiple Cross Site Scripting Vulnerabilities

References:

• My Image Gallery Change Log (My Image Gallery)
  
• My Image Gallery Web Site (My Image Gallery)