Joomgallery Extension For Joomla
Monthly
Stored cross-site scripting in JoomGallery (Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 allows a privileged authenticated attacker to inject a persistent JavaScript payload into image metadata, which then executes in the browser of every subsequent visitor who views that image or gallery. The attacker plants the payload once and it fires automatically for all future visitors, making this a force-multiplier attack despite the high-privilege prerequisite. No public exploit or active exploitation via CISA KEV has been identified at time of analysis; the fix is upgrading to version 4.3.1.
Password-protected gallery categories in JoomGallery versions prior to 4.3.1 are fully accessible to unauthenticated remote attackers by switching the request format to JSON via the `format=json` URL parameter. The HTML view correctly enforces the password gate, but the JSON view controller lacks any equivalent access control check, exposing protected image metadata and content without requiring credentials. No public exploit has been identified at time of analysis, though the bypass is trivially replicable directly from the vulnerability description.
Stored cross-site scripting in JoomGallery (Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 allows a privileged authenticated attacker to inject a persistent JavaScript payload into image metadata, which then executes in the browser of every subsequent visitor who views that image or gallery. The attacker plants the payload once and it fires automatically for all future visitors, making this a force-multiplier attack despite the high-privilege prerequisite. No public exploit or active exploitation via CISA KEV has been identified at time of analysis; the fix is upgrading to version 4.3.1.
Password-protected gallery categories in JoomGallery versions prior to 4.3.1 are fully accessible to unauthenticated remote attackers by switching the request format to JSON via the `format=json` URL parameter. The HTML view correctly enforces the password gate, but the JSON view controller lacks any equivalent access control check, exposing protected image metadata and content without requiring credentials. No public exploit has been identified at time of analysis, though the bypass is trivially replicable directly from the vulnerability description.