What the vulnerability does
01Description
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue.
Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
Explanation of Vulnerability in Simple Terms
02Summary
PhotoGallery versions 1.0.1 through 1.8.21 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker can craft a malicious link that, when clicked by a site visitor, executes JavaScript in the victim's browser. The injected script can steal session cookies, redirect users, or perform actions on their behalf. This affects the integrity and confidentiality of user interactions with the site.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in a visitor's browser to steal data or perform unauthorized actions.
Potential impact on your site
04Site Impact
Visitors to your site can be compromised; their session cookies or credentials may be stolen, or they may be redirected to malicious sites.
Conditions required to exploit
05Prerequisites
Attacker must trick a site visitor into clicking a malicious link (user interaction required). No authentication needed.
Key dates
06Disclosure timeline
March 26, 2024
CVE published
August 2, 2024
Record updated
