Cross-site scripting (XSS) vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag.

Several remote vulnerabilities have been discovered in gallery, a web-based photo album. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-2734     A cross-site scripting vulnerability allows injection of     web script code through HTML or EXIF information.

  - CVE-2006-0330     A cross-site scripting vulnerability in the user     registration allows injection of web script code.

  - CVE-2006-4030     Missing input sanitising in the stats modules allows     information disclosure.

According to its banner, the version of Gallery hosted on the remote web server is prone to script insertion attacks because it does not sanitize malicious EXIF data stored in image files.  Using a specially crafted image file, an attacker can exploit this flaw to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected application.

The remote host is running Gallery, a web-based photo album. According to its banner, the version of Gallery installed on the remote host is prone to script insertion attacks because it does not sanitize malicious EXIF data stored in image files.  Using a specially-crafted image file, an attacker can exploit this flaw to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected application.

ID	Name	Product	Family	Severity
22690	Debian DSA-1148-1 : gallery - several vulnerabilities	Nessus	Debian Local Security Checks	medium
19512	Gallery EXIF Data XSS	Nessus	CGI abuses : XSS	medium
3185	Gallery < 1.5.3-RC3 EXIF Data XSS	Nessus Network Monitor	CGI	low

Detections

Analytics

CVE-2005-2734

medium

Tenable Plugins

medium

medium

low