[UNIX] GOOP Gallery 'image' Parameter Cross Site Scripting

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  GOOP Gallery 'image' Parameter Cross Site Scripting
------------------------------------------------------------------------


SUMMARY

GOOP Gallery contains a flaw that allows a remote cross site scripting 
attack. This flaw exists because the application does not validate 'image' 
parameter upon submission to index.php script. This could allow a user to 
create a specially crafted URL that would execute arbitrary code in a 
user's browser within the trust relationship between the browser and the 
server, leading to a loss of integrity.

DETAILS

Vulnerable Systems:
 * GOOP Gallery version 2.0

Immune Systems:
 * GOOP Gallery version 2.0.3

Solution:
Upgrade to GOOP gallery 2.0.3 as soon as possible, further details are 
available at:  <http://webgeneius.com/index.php?mod=blog&id=49> 
http://webgeneius.com/index.php?mod=blog&id=49

You can download GOOP gallery version 2.0.3 from:  
<http://webgeneius.com/downloads/gg2.0.3.zip> 
http://webgeneius.com/downloads/gg2.0.3.zip

Exploit:
The following two URLs can be used to test the system:
http://Victim/goopgallery/index.php?next=%BB&gallery=demo+gallery+1&image=Bunny.JPG";>[XSS-CODE]
http://Victim/goopgallery/index.php?gallery=demo+gallery+1&image=Bunny.JPG";>[XSS-CODE]


ADDITIONAL INFORMATION

The information has been provided by  <mailto:lostmon@gmail.com> Lostmon.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.