Plugin inspection:

NextGEN Gallery

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

This recommendation applies to version 2.0.31 of this plugin, but the most recent version is 3.59.7. These findings may no longer be correct.

Findings

The plugin is extremely large at over 31,000 lines. Generates errors when run. Uses exec() without escaping its arguments. Contains unescaped SQL queries. Not all variables are escaped at the point where they are output. It allows listing the contents of directories. During testing it went berserk and caused a denial of service on one tester’s machine by getting stuck in an infinite loop after deleting a file.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

We found a large number of problems with this plugin despite not having enough time to inspect many of its 31,000 lines of code during this inspection.

We are confident that this plugin is unsafe.

Failure criteria

  • Lack of input sanitisation
  • Execution of unprepared SQL statements
  • Unsafe file or network IO
  • Lack of proper output escaping
  • Unsafe execution of system commands

Read more about our failure criteria.