Mambo.Galleria.galleria.html.php.File.Inclusion

Alias(es) Galleria.galleria.html.php.File.Inclusion
Release Date Feb 02, 2007
Severity medium
Impact Gain Access
Description Galleria has a remote file-include vulnerability. A remote attacker could execute an arbitrary script on the web server with the privileges of the server, via a specially-crafted URL request to the galleria.html.php script, by using the 'mosConfig_absolute_path' parameter to specify a malicious PHP file from a remote system.
Affected Products Galleria version 1.0 and prior.
Recommended Actions Apply patch : http://forum.mamboserver.com/showthread.php?t=83001
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2006-3396
Reference/s http://www.frsirt.com/english/advisories/2006/2666 (FrSIRT) http://www.securityfocus.com/bid/18808 (BugTraq)

Fortinet