Hello,<br><br>I was looking at the free version of gallarific, and I found some suspicious code in the scopbin directory.<br>Attached is a file I found in the zip i downloaded, in case someone wants to decode it.<br><br>the package can be downloaded from <br>
<a href="http://www.gallarific.com/download.php">http://www.gallarific.com/download.php</a><br><br>Also, the software contains several xss flaws:<br><br>1) When modifying a user his email address like<br><a href="mailto:h@h.com">h@h.com</a>"><script>alert(1);</script><br>
persistent xss wil occur when viewing gadmin/users.php or moderating the comments in gadmin/comments.php<br><br>2) When adding a comment like "><script>alert(1)</script> , xss will occur when moderating the comments<br>
<br>3) gallery/tags.php?tag="><script>alert(1)</script><br><br>4) probably more bugs.<br><br>Regards,<br>Thomas Pollet<br><br>