CVE-2003-1227 PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, al

What is CVE-2003-1227?

CVE-2003-1227 is a high-severity vulnerability in n/a, published on 16 Aug 2005.

Official description

PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412. NOTE: this issue might be exploitable only during installation, or if the administrator has not run a security script after installation.

Weakness: CWE-94

Which versions are affected by CVE-2003-1227?

It affects 1 product.

Products include Gallery Project Gallery.

How do I fix CVE-2003-1227?

No fix has been published for CVE-2003-1227 yet. Limit exposure of the affected software until one is available.

Is CVE-2003-1227 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2003-1227 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2012-4919 File upload in Gallery Critical 9.8
• CVE-2002-2130 Code injection in n/a High 7.5
• CVE-2002-2123 PHP remote file inclusion vulnerability in publish_xp_docs.php for Gallery 1.3.2 allows remote attackers to inject arbitrary PHP code by spe High 7.5
• CVE-2004-1466 File upload in n/a High 7.5
• CVE-2002-1412 Code injection in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-74q5-9hvp-962c.