PT-2008-3036 · Gallarific · Gallarific Free Edition

Published 2008-03-24 · Updated 2011-07-25 · CVE-2008-1469

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gallarific Free Edition version 1.1

Description The issue allows remote attackers to edit objects without authentication via direct requests to certain API endpoints, specifically "photos.php", "comments.php", and "gallery.php" in the "gadmin/" directory.

Recommendations For Gallarific Free Edition version 1.1, consider restricting access to the "gadmin/" directory and its contents, specifically the "photos.php", "comments.php", and "gallery.php" endpoints, until a proper authentication mechanism is implemented. As a temporary workaround, restrict direct requests to these endpoints to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-1469

Affected Products

Gallarific Free Edition

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2008-1469 · Security Note
• http://secunia.com/advisories/29399 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1469 · Note