This module enables you to display any number of galleries based on images located in the files folder.
The module doesn't sufficiently sanitize various database queries which may allow attackers to craft requests resulting in an SQL injection vulnerability. This vulnerability could be exploited even by anonymous users and could potentially allow them to take over the site.
The module doesn't sufficiently confirm a user's intent to save checklist data, which allows for a cross-site request forgery (CSRF) exploit to be executed by unprivileged users.
Some configuration fields are not filtered while rendered, resulting in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer Brilliant Gallery".
Install the latest version:
- If you use the Brilliant Gallery module for Drupal 7, upgrade to Brilliant Gallery 7.x-1.10
- Tomas Fulopp, the module maintainer
- Greg Knaddison of the Drupal Security Team
