Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: CGI abuses --> Category: attack

Gallery stepOrder Parameter Local File Include Vulnerabilities Vulnerability Scan

Vulnerability Scan Summary
Tries to read a file using Gallery stepOrder parameter

Detailed Explanation for this Vulnerability Test

Synopsis :

The remote web server contains a PHP application that is affected by
multiple local file include flaws.

Description :

The remote host is running Gallery, a web-based photo album
application written in PHP.

The version of Gallery installed on the remote host fails to sanitize
input to the 'stepOrder' parameter of the 'upgrade/index.php' and
'install/index.php' scripts before using it in a PHP 'require()'
function. An unauthenticated attacker may be able to exploit this
issue to view arbitrary files or to execute arbitrary PHP code on the
affect host provided PHP's 'register_globals' setting is enabled.

See also :

Solution :

Disable PHP's 'register_globals' setting, delete the application's
'upgrade/index.php' script, or upgrade to Gallery version 2.0.4 /
2.1-RC-2a or later.

Threat Level:

Low / CVSS Base Score : 2.3

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.