Needyamin Image Gallery Cross-Site Scripting Vulnerability in view.php

A cross-site scripting (XSS) vulnerability has been identified in Needyamin Image Gallery version 1.0. The issue arises in the view.php file, specifically within the image_gallery function, where the Username parameter is not properly sanitized. This flaw allows remote attackers to inject malicious scripts that could be executed in the context of the user's browser. The vulnerability has been publicly disclosed and could potentially lead to an admin account takeover, as the injected scripts could be used to steal cookies and impersonate the user.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser. This could lead to cookie theft and unauthorized access to admin accounts.

Reproduction

To reproduce this vulnerability, send a request to view.php with a crafted username parameter that includes a script tag. The absence of XSS protections will allow the script to execute, demonstrating the cross-site scripting vulnerability.