SelectaPix Input Validation Flaws in 'albumID' and 'imageID' Parameters Permit Cross-Site Scripting and SQL Injection Attacks
|
|
SecurityTracker Alert ID: 1016256
|
|
SecurityTracker URL: http://securitytracker.com/id?1016256
|
|
CVE Reference: CVE-2006-2912
, CVE-2006-2913
(Links to External Site)
|
Date: Jun 9 2006
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Advisory: Secunia Research
|
Version(s): 1.31; possibly other versions
|
Description: A vulnerability was reported in SelectaPix. A remote user can conduct cross-site scripting attacks. A remote user can inject SQL commands.
The software does not properly validate user-supplied input in the 'albumID' and 'imageID' parameters. A remote user can supply
a specially crafted parameter value to execute SQL commands on the underlying database. This can be exploited to gain administrative
access on the target application.
Some demonstration exploit URLs are provided:
http://[target]/view_album.php?albumID=[code]
http://[target]/popup.php?albumID=2&i
mageID=[code]
http://[target]/index.php?albumID=[code]
The 'popup.php' and 'view_album.php' scripts do not properly filter HTML
code from user-supplied input in the 'albumID' parameter before displaying the input. A remote user can create a specially crafted
URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code
will originate from the site running the SelectaPix software and will run in the security context of that site. As a result, the
code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access
data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
The
vendor was notified on May 17, 2006.
Andreas Sandblad of Secunia Research discovered these vulnerabilities.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
SelectaPix software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
A remote user can execute SQL commands on the underlying database.
|
Solution: The vendor has issued a fixed version (1.4), available at:
http://www.outofthetrees.co.uk/selectapix/index.php
|
Vendor URL: www.outofthetrees.co.uk/selectapix/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Secunia Research <remove-vuln@secunia.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 09 Jun 2006 09:30:31 +0200
From: Secunia Research <remove-vuln@secunia.com>
Subject: [Full-disclosure] Secunia Research: SelectaPix Cross-Site Scripting
|
======================================================================
Secunia Research 09/06/2006
- SelectaPix Cross-Site Scripting and SQL Injection Vulnerabilities -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerabilities.......................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
* SelectaPix 1.31
Prior versions may also be affected.
======================================================================
2) Severity
Rating: Moderately critical
Impact: Manipulation of data and cross-site scripting
Where: Remote
======================================================================
3) Vendor's Description of Software
SelectaPix is a free (GPL Licence), highly configurable PHP/MySQL
image gallery system which can be integrated into your existing site
in minutes. The password-protected admin section allows you to upload
up to 10 jpeg images in one go, and arrange them into albums and
sub-albums.
Product link:
http://www.outofthetrees.co.uk/selectapix/index.php
======================================================================
4) Description of Vulnerabilities
Secunia Research has discovered some vulnerabilities in SelectaPix,
which can be exploited by malicious people to conduct
cross-site scripting and SQL injection attacks.
1) Some input is not properly sanitised before being used in a SQL
query. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.
Examples:
http://[host]/view_album.php?albumID=[code]
http://[host]/popup.php?albumID=2&imageID=[code]
http://[host]/index.php?albumID=[code]
* The "username" and "passwd" parameters passed in "admin/member.php".
This can further be exploited to bypass the authentication process and
access the administration section.
Successful exploitation requires that "magic_quotes_gpc" is disabled
(except for the "albumID" parameter).
2) Input passed to the "albumID" parameter in "popup.php" and
"view_album.php" is not properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.
The vulnerabilities have been confirmed in version 1.31. Prior
versions may also be affected.
======================================================================
5) Solution
Update to version 1.4.
http://www.outofthetrees.co.uk/selectapix/index.php
======================================================================
6) Time Table
17/05/2006 - Initial vendor notification.
31/05/2006 - Vendor confirms vulnerabilities.
09/06/2006 - Public disclosure.
======================================================================
7) Credits
Discovered by Andreas Sandblad, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-2912 (SQL injection) and CVE-2006-2913 (cross-site scripting)
for the vulnerabilities.
======================================================================
9) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-39/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
