Bharat Mediratta Gallery Remote Arbitrary Code Execution Vulnerability

Bugtraq ID:	3397
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 02 2001 12:00AM
Updated:	Oct 02 2001 12:00AM
Credit:	This vulnerability was discovered and posted to BugTraq by: [email protected].
Vulnerable:	Bharat Mediratta Gallery 1.2 - Francisco Burzi PHP-Nuke 5.0 Bharat Mediratta Gallery 1.1
Not Vulnerable:	Bharat Mediratta Gallery 1.2.1 - Francisco Burzi PHP-Nuke 5.0

Bharat Mediratta Gallery Remote Arbitrary Code Execution Vulnerability

Gallery is freely available, open-source web based gallery software. It allows users to create their own web galleries based on a template.

A problem exists in Gallery that will allow a remote attacker to execute arbitrary code on a host running the software(with the privileges of the webserver process). It is possible to supply arbitrary data to the $include variable. As a result, the affected script may be redirected to execute arbitrary code located on an external host, as specified by the attacker.

This issue can be exploited if the remote attacker submits a maliciously crafted URL.

Bharat Mediratta Gallery Remote Arbitrary Code Execution Vulnerability

This vulnerability can be exploited with a web browser.

Bharat Mediratta Gallery Remote Arbitrary Code Execution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Bharat Mediratta Gallery Remote Arbitrary Code Execution Vulnerability

References:

• Gallery (Bharat Mediratta)