The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Gallery | Gallery_project | 1.3.1 | 1.3.1 |
Gallery | Gallery_project | 1.3.2 | 1.3.2 |
Gallery | Gallery_project | 1.4.1 | 1.4.1 |
Gallery | Gallery_project | 1.3.3 | 1.3.3 |
Gallery | Gallery_project | 1.4 | 1.4 |