PT-2010-3377 · Gallo · Gallo

Cr4Wl3R · Published 2010-05-06 · Updated 2010-05-07 · CVE-2010-1737

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gallo version 0.1.0

Description The issue allows remote attackers to execute arbitrary PHP code when magic quotes gpc is disabled. This is achieved via a URL in the config[gfwroot] parameter.

Recommendations For Gallo version 0.1.0, consider disabling the use of the config[gfwroot] parameter until a patch is available, or enable magic quotes gpc to prevent the execution of arbitrary PHP code.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-1737

Affected Products

Gallo

References · 7

• 🔥 https://exploit-db.com/exploits/12488 · Exploit
• 🔥 http://packetstormsecurity.org/1005-exploits/gallo-rfi.txt · Exploit
• 🔥 http://securityfocus.com/bid/39890 · Exploit
• 🔥 http://exploit-db.com/exploits/12488 · Exploit
• http://vupen.com/english/advisories/2010/1060 · Vendor Advisory
• http://secunia.com/advisories/39706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1737 · Security Note