Release Date

Severity

Impact

Description

It indicates a possible exploit of file include vulnerability in Squito Gallery.

Squito Gallery is an open source gallery management application written in PHP, uses MySQL as backend database. A vulnerability is reported in it that may allow an attacker to execute arbitrary PHP code on the vulnerable server. This is due to photolist.inc.php script failure to sanitize value passed to photoroot parameter on a request. For exploiting this an attacker may convince a victim to click a malicious URL link to include and execute arbitrary files from external and local resources. Successful exploitation requires that "register_globals" is enabled.

Affected Products

Recommended Actions

Coverage

Common Vulnerabilities and Exposures (CVE)

Reference/s