CVE-2003-1227
Gallery 1.4 and 1.4-pl1 - Remote Code Execution via GALLERY_BASEDIR Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2003-1227. PoCs published by peter.
AI-analyzed exploit summary This exploit leverages a remote file inclusion vulnerability in Gallery's index.php script by manipulating the GALLERY_BASEDIR parameter to include arbitrary PHP code from an attacker-controlled server. The vulnerability arises due to insufficient input validation.
Description
PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412. NOTE: this issue might be exploitable only during installation, or if the administrator has not run a security script after installation.
Exploits (1)
This exploit leverages a remote file inclusion vulnerability in Gallery's index.php script by manipulating the GALLERY_BASEDIR parameter to include arbitrary PHP code from an attacker-controlled server. The vulnerability arises due to insufficient input validation.