gallarific-xss.txt

`Hello,  
  
I was looking at the free version of gallarific, and I found some suspicious  
code in the scopbin directory.  
Attached is a file I found in the zip i downloaded, in case someone wants to  
decode it.  
  
the package can be downloaded from  
http://www.gallarific.com/download.php  
  
Also, the software contains several xss flaws:  
  
1) When modifying a user his email address like  
[email protected]"><script>alert(1);</script>  
persistent xss wil occur when viewing gadmin/users.php or moderating the  
comments in gadmin/comments.php  
  
2) When adding a comment like "><script>alert(1)</script> , xss will occur  
when moderating the comments  
  
3) gallery/tags.php?tag="><script>alert(1)</script>  
  
4) probably more bugs.  
  
Regards,  
Thomas Pollet  
`