CVE-2019-1010123

Name of the Vulnerable Software and Affected Versions: MODX Revolution Gallery version 1.7.0

Description: The issue allows creating a file with custom filename and content. It involves filtering user parameters before passing them into the phpthumb class. The attack vector is a web request via the "/assets/components/gallery/connector.php" API endpoint.

Recommendations: For MODX Revolution Gallery version 1.7.0, consider restricting access to the /assets/components/gallery/connector.php API endpoint until a patch is available. As a temporary workaround, filtering user parameters more strictly before passing them into the phpthumb class may help minimize the risk of exploitation.