Cross-site scripting vulnerability in login.php in Gallery 1.4.4-pl2 allows remote attackers to inject arbitrary web script or HTML via the username field.

Gallery includes several cross-site scripting vulnerabilities that could allow malicious content to be injected.

The remote host is affected by the vulnerability described in GLSA-200501-45 (Gallery: XSS vulnerability)

    Rafel Ivgi has discovered a cross-site scripting vulnerability where     the 'username' parameter is not properly sanitized in 'login.php'.
  Impact :

    By sending a carefully crafted URL, an attacker can inject and execute     script code in the victim's browser window, and potentially compromise     the user's gallery.
  Workaround :

    There is no known workaround at this time.

The remote host is running the Gallery web-based photo album.
There are various flaws in the remote version of this software that may allow an attacker to perform a cross-site scripting attack using the remote host, or to exploit an information disclosure flaw to gain more knowledge about the remote system.

The version of Gallery hosted on the remote web server is affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'username' parameter of the 'login.php' script.  An attacker could exploit this flaw to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site. 

Note that the application is reportedly affected by multiple additional cross-site scripting vulnerabilities as well as an information disclosure vulnerability, although Nessus has not tested for these.

ID	Name	Product	Family	Severity
18940	FreeBSD : gallery -- XSS (5752a0df-60c5-4876-a872-f12f9a02fa05)	Nessus	FreeBSD Local Security Checks	medium
16436	GLSA-200501-45 : Gallery: XSS vulnerability	Nessus	Gentoo Local Security Checks	medium
2533	Gallery Multiple Vulnerabilities	Nessus Network Monitor	CGI	low
16185	Gallery login.php username Parameter XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2005-0220

medium

Tenable Plugins

medium

medium

low

medium