Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.