Gallery < 1.5.8 modules.php phpEx Parameter Traversal Local File Inclusion
medium Nessus Network Monitor Plugin ID 4619
Synopsis
The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files or data.
Description
The remote host is running Gallery, a web-based photo album application written in PHP. The version of Gallery installed on the remote host is less than 1.5.8. This version of Gallery is vulnerable to a local file inclusion vulnerability. The root of the flaw is in the 'phpEx' parameter of the '/contrib/phpBB2/modules.php' script. An attacker exploiting this flaw would send a specially formatted request to the modules.php application. The request would likely include a directory traversal to some local file on the server. e.g. '../../../etc/passwd'. Successful exploitation would result in the attacker gaining 'read' access to confidential files.
