CVE-2001-1234

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html
http://prdownloads.sourceforge.net/gallery/gallery-1.2.5.tar.gz
http://www.iss.net/security_center/static/7215.phpPatch, Vendor Advisory
http://www.osvdb.org/1967
http://www.securityfocus.com/bid/3397Exploit, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html
http://prdownloads.sourceforge.net/gallery/gallery-1.2.5.tar.gz
http://www.iss.net/security_center/static/7215.phpPatch, Vendor Advisory
http://www.osvdb.org/1967
http://www.securityfocus.com/bid/3397Exploit, Vendor Advisory

Timeline

Published: Oct 2, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-12357.5pSlash PHP script 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP CVE-2001-12367.5myphpPagetool PHP script 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, usi CVE-2001-12377.5Phormation PHP script 0.9.1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an CVE-2001-12387.8Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) s CVE-2001-12395.0PowerNet IX allows remote attackers to cause a denial of service via a port scan.CVE-2001-124010.0The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be lev CVE-2001-12417.5Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to ex CVE-2001-12427.5Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an HTML CVE-2001-12435.0Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) vi CVE-2001-12445.0Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum CVE-2001-12455.0Opera 5.0 for Linux does not properly handle malformed HTTP headers, which allows remote attackers to cause a denial of service, possibly wi CVE-2001-12467.5PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possib