PlanetGallery Gallery_admin.PHP Authentication Bypass Vulnerability

Bugtraq ID:	17753
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 01 2006 12:00AM
Updated:	May 01 2006 07:40PM
Credit:	tugr@ and AlpEren are credited with the discovery of this vulnerability.
Vulnerable:	PlaNet Concept planetGallery 0
Not Vulnerable:

PlanetGallery Gallery_admin.PHP Authentication Bypass Vulnerability

PlanetGallery is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials.

An attacker can exploit this issue to bypass authentication and gain admin access. This could aid in further attacks on the affected computer.

PlanetGallery Gallery_admin.PHP Authentication Bypass Vulnerability

This issue can be exploited through a web client.

An example URI has been provided:

• /data/vulnerabilities/exploits/planetGallery-auth-bypass.txt

PlanetGallery Gallery_admin.PHP Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

PlanetGallery Gallery_admin.PHP Authentication Bypass Vulnerability

References:

• Planet Gallery Web Site (Planet Concept)
  
• planetGallery admin login ([email protected])