SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   SelectaPix Vendors:   Out of the Trees Web Design
SelectaPix Input Validation Flaws in 'albumID' and 'imageID' Parameters Permit Cross-Site Scripting and SQL Injection Attacks
SecurityTracker Alert ID:  1016256
SecurityTracker URL:  http://securitytracker.com/id/1016256
CVE Reference:   CVE-2006-2912, CVE-2006-2913   (Links to External Site)
Date:  Jun 9 2006
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.31; possibly other versions
Description:   A vulnerability was reported in SelectaPix. A remote user can conduct cross-site scripting attacks. A remote user can inject SQL commands.

The software does not properly validate user-supplied input in the 'albumID' and 'imageID' parameters. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database. This can be exploited to gain administrative access on the target application.

Some demonstration exploit URLs are provided:

http://[target]/view_album.php?albumID=[code]
http://[target]/popup.php?albumID=2&imageID=[code]
http://[target]/index.php?albumID=[code]

The 'popup.php' and 'view_album.php' scripts do not properly filter HTML code from user-supplied input in the 'albumID' parameter before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the SelectaPix software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

The vendor was notified on May 17, 2006.

Andreas Sandblad of Secunia Research discovered these vulnerabilities.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the SelectaPix software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A remote user can execute SQL commands on the underlying database.

Solution:   The vendor has issued a fixed version (1.4), available at:

http://www.outofthetrees.co.uk/selectapix/index.php

Vendor URL:  www.outofthetrees.co.uk/selectapix/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] Secunia Research: SelectaPix Cross-Site Scripting

======================================================================

                     Secunia Research 09/06/2006

 - SelectaPix Cross-Site Scripting and SQL Injection Vulnerabilities -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerabilities.......................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

* SelectaPix 1.31

Prior versions may also be affected.

======================================================================
2) Severity

Rating: Moderately critical
Impact: Manipulation of data and cross-site scripting
Where:  Remote

======================================================================
3) Vendor's Description of Software

SelectaPix is a free (GPL Licence), highly configurable PHP/MySQL 
image gallery system which can be integrated into your existing site 
in minutes. The password-protected admin section allows you to upload 
up to 10 jpeg images in one go, and arrange them into albums and 
sub-albums.

Product link:
http://www.outofthetrees.co.uk/selectapix/index.php

======================================================================
4) Description of Vulnerabilities

Secunia Research has discovered some vulnerabilities in SelectaPix, 
which can be exploited by malicious people to conduct 
cross-site scripting and SQL injection attacks.

1) Some input is not properly sanitised before being used in a SQL 
query. This can be exploited to manipulate SQL queries by injecting 
arbitrary SQL code.

Examples:
http://[host]/view_album.php?albumID=[code]
http://[host]/popup.php?albumID=2&imageID=[code]
http://[host]/index.php?albumID=[code]
* The "username" and "passwd" parameters passed in "admin/member.php".

This can further be exploited to bypass the authentication process and 
access the administration section.

Successful exploitation requires that "magic_quotes_gpc" is disabled 
(except for the "albumID" parameter).

2) Input passed to the "albumID" parameter in "popup.php" and 
"view_album.php" is not properly sanitised before being returned to 
the user. This can be exploited to execute arbitrary HTML and script 
code in a user's browser session in context of an affected site.

The vulnerabilities have been confirmed in version 1.31. Prior 
versions may also be affected.

======================================================================
5) Solution

Update to version 1.4.
http://www.outofthetrees.co.uk/selectapix/index.php

======================================================================
6) Time Table

17/05/2006 - Initial vendor notification.
31/05/2006 - Vendor confirms vulnerabilities.
09/06/2006 - Public disclosure.

======================================================================
7) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2006-2912 (SQL injection) and CVE-2006-2913 (cross-site scripting)
for the vulnerabilities.

======================================================================
9) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-39/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC