[UNIX] singapore Image Gallery Web Application Multiple Vulnerabilities

From: SecuriTeam (support_at_securiteam.com)
Date: 12/20/04

  • Next message: SecuriTeam: "[NEWS] Yahoo! Mail Cross-Site Scripting Vulnerability" 
    To: list@securiteam.com
Date: 20 Dec 2004 18:14:16 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      singapore Image Gallery Web Application Multiple Vulnerabilities
    ------------------------------------------------------------------------

    SUMMARY

     <http://singapore.sourceforge.net/> singapore is "yet another open source
    PHP based image gallery web application. What makes it different from the
    hundreds of other similar scripts is that it is specifically geared
    towards displaying art in an aesthetically pleasing fashion using a clean,
    uncluttered interface".

    Multiple vulnerabilities were found in the singapore Image Gallery Web
    application including arbitrary file download, directory deletion and
    Cross-Site Scripting (XSS).

    DETAILS

    Vulnerable Systems:
     * singapore Image Gallery Web Application version 0.9.10

    Immune Systems:
     * singapore Image Gallery Web Application version 0.9.11

    1. Insufficient checks to prevent directory traversal in thumb.php
    showThumb() method allows arbitrary file download. This may be exploited
    to download the encrypted password file in
    /install_dir/data/users.csv.php.

    2. Insufficient filename checks in admin.class.php addImage() function may
    allow arbitrary file upload. This may be exploited by a malicious logon
    user to upload arbitrary PHP scripts instead of image files.

    3. Insufficient checks to prevent directory traversal in admin.class.php
    allow deletion of arbitrary directory that the scripts has delete access
    to. On a Windows platform, deletion of arbitrary directories that the web
    server has write access to is also possible.

    4. Multiple Cross-Site Scripting (XSS) Vulnerabilities

    Disclosure Timeline:
    17 Nov 04 - Vulnerability Discovered.
    17 Nov 04 - Initial Author Notification by Email.
    17 Nov 04 - Initial Author Reply.
    18 Nov 04 - Second Author Notification.
    19 Nov 04 - Received patch from Author, but it does not work.
    19 Nov 04 - Informed Author that patch does not work.
    30 Nov 04 - Third Author Notification.
    03 Dec 04 - Author provided fix.
    15 Dec 04 - Author Released Version 0.9.11.
    16 Dec 04 - Public Release.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:chewkeong@security.org.sg>
    Tan Chew Keong.
    The original article can be found at:
    <http://www.security.org.sg/vuln/singapore0910.html>
    http://www.security.org.sg/vuln/singapore0910.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Yahoo! Mail Cross-Site Scripting Vulnerability"

    Relevant Pages