Dacio's Image Gallery 1.6 - Multiple Remote Vulnerabilities

source: https://www.securityfocus.com/bid/34906/info

Dacio's Image Gallery is prone to multiple remote vulnerabilities:

- An arbitrary-file-upload vulnerability
- An authentication-bypass vulnerability
- A directory-traversal vulnerability

An attacker can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the webserver process, view arbitrary local files, or gain unauthorized access to the affected application.

Dacio's Image Gallery 1.6 is vulnerable; other versions may also be affected.

The following example URI for the directory-traversal vulnerability is available:

http://www.example.com/Dacio_imgGal-v1.6/index.php?gallery=../config.inc%00