WordPress UnGallery 'source_vuln.php' Local File Disclosure Vulnerability

Bugtraq ID:	49259
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 20 2011 12:00AM
Updated:	Aug 20 2011 12:00AM
Credit:	Miroslav Stampar
Vulnerable:	WordPress UnGallery 1.5.8
Not Vulnerable:

WordPress UnGallery 'source_vuln.php' Local File Disclosure Vulnerability

The UnGallery plug-in for WordPress is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

UnGallery versions 1.5.8 and prior are vulnerable.

WordPress UnGallery 'source_vuln.php' Local File Disclosure Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/49259.py

WordPress UnGallery 'source_vuln.php' Local File Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WordPress UnGallery 'source_vuln.php' Local File Disclosure Vulnerability

References:

• Product Homepage (Wordpress)
  
• WordPress Home Page (WordPress)