Auth bypass in Truegalerie

CVE-2003-1489

upload.php in Truegalerie 1.0 allows remote attackers to read arbitrary files by specifying the target filename in the file cookie in form.php, then downloading the file from the image gallery.

Vulnerability class: Broken Authentication

EPSS: 0.009 (56.1th percentile) — read the EPSS interpretation.

Affected products

Truegalerie — versions 1.0
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (mailing-list, x_refsource_VULNWATCH)
cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)