FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-2124

This CVE name corresponds to:

Entered	Topic
2005-06-17	gallery -- remote code injection via HTTP_POST_VARS

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-2124 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-2124
Phase	Assigned(20050527)

Description

The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.

References

Source	Reference
BUGTRAQ	20040127 Remote exploit in Gallery 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1
GENTOO	GLSA-200402-04
CONFIRM	http://gallery.menalto.com/modules.php?op=modload&name=News&file=index
BID	9490
OSVDB	3737
SECUNIA	10712
XF	gallery-gallerybasedir-file-include(14950)