ARWScripts Gallery Script Lite 'download.html' File Disclosure Vulnerability

Bugtraq ID:	28718
Class:	Input Validation Error
CVE:	CVE-2008-1730
Remote:	Yes
Local:	No
Published:	Apr 09 2008 12:00AM
Updated:	May 07 2015 05:30PM
Credit:	JIKI Team
Vulnerable:	ARWScripts Gallery Script Lite 0
Not Vulnerable:

ARWScripts Gallery Script Lite 'download.html' File Disclosure Vulnerability

ARWScripts Gallery Script Lite is prone to a file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal attacks to view local files in the context of the webserver process. This may aid in further attacks.

ARWScripts Gallery Script Lite 'download.html' File Disclosure Vulnerability

Attackers can exploit this issue via a browser.

The following proof-of-concept URI is available:

http://www.example.com/download.html?path=config.inc.php

ARWScripts Gallery Script Lite 'download.html' File Disclosure Vulnerability

Solution:
The vendor has released updates. Contact the vendor for details on obtaining and applying the appropriate updates.

ARWScripts Gallery Script Lite 'download.html' File Disclosure Vulnerability

References:

• Gallery Script Lite Homepage (ARWScripts)