Gallery "steporder[]" Local File Inclusion Vulnerability

[TCH-Thomas]

From Secunia

 

Description:

rgod has discovered a vulnerability in Gallery, which can be exploited by malicious people to disclose sensitive information and compromise a vulnerable system.

 

Input passed to the "stepOrder[]" parameter in "upgrade/index.php" and "install/index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

 

Successful exploitation requires that "magic_quotes_gpc" is disabled and that "register_globals" is enabled.

 

This can further be exploited to include arbitrary PHP code injected into "g2data/plugins_data/modules/watermark".

 

The vulnerability has been confirmed in version 2.0.3 and has also been reported in prior versions. Other versions may also be affected.

 

Solution:

Edit the source code to ensure that input is properly verified.

 

Set "register_globals" to "Off".

[TCH-Bruce]

Thanks Thomas

[TCH-Don]

Thanks Thomas

[TCH-Rob]

Thanks Thomas

[TCH-Thomas]

I think but not sure that this release will patch this vulnerability.