James Bercegay has reported some vulnerabilities in Gallery, which can be exploited by malicious people to conduct script insertion attacks and to bypass certain security restrictions.

1) Input passed to "getRemoteHostAddress()" via the X_FORWARDED_FOR HTTP header isn't properly sanitised before being saved. This can be exploited to spoof the IP address that is logged when adding comments in an album, or to execute arbitrary HTML and script code in a user's browser session in context of an affected website when a malicious comment is viewed.

2) Input passed in the session id isn't properly sanitised before being used. This can be exploited to delete arbitrary files accessible to the web server process.

The vulnerabilities have been reported in version 2 through 2.0.2.

Solution
Update to version 2.0.3.
Further details available to Secunia VIM customers

Provided and/or discovered by
James Bercegay, GulfTech Security Research Team.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://gallery.menalto.com/gallery_2.0.3_released
http://www.gulftech.org/?node=research&article_id=00106-03022006

Deep Links
Links available to Secunia VIM customers