Singapore 0.9.9b Beta – Image Gallery Remote File Inclusion / Cross-Site Scripting
source: https://www.securityfocus.com/bid/65420/info Singapore Image Gallery is prone to a remote file-include vulnerability and a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or steal cookie-based authentication credentials and launch other attacks. Singapore 0.9.9b and 0.9.10 are vulnerable; other versions may also be vulnerable. http://www.example.com/thumb.php?gallery=./00000000000-764&height=100&image=[File Upload] |