<<< Date Index >>>     <<< Thread Index >>>

[SIG^2 G-TEC] singapore Image Gallery Web Application v0.9.10 Multiple Vulnerabilities




SIG^2 Vulnerability Research Advisory

singapore Image Gallery Web Application v0.9.10 Multiple Vulnerabilities

by Tan Chew Keong
Release Date: 16 Dec 2004


ADVISORY URL
http://www.security.org.sg/vuln/singapore0910.html


SUMMARY

singapore (http://singapore.sourceforge.net/) is yet another open source PHP 
based image gallery web application. What makes it different from the hundreds 
of other similar scripts is that it is specifically geared towards displaying 
art in an aesthetically pleasing fashion using a clean, uncluttered interface.

Multiple vulnerabilies were found in the image gallery web application 
including arbitrary file download, directory deletion and Cross-Site Scripting 
(XSS). 


TESTED SYSTEM

singapore Image Gallery Web Application Version 0.9.10 on English Win2K IIS 
with PHP 4.3.4, 4.3.9

singapore Image Gallery Web Application Version 0.9.10 on Linux Apache/1.3.33 
(Unix) PHP/4.3.9

 
DETAILS

Multiple vulnerabilies were found in the image gallery web application 
including arbitrary file download, directory deletion and Cross-Site Scripting 
(XSS).

1. Insufficient directory traversal check in thumb.php showThumb() method may 
allow arbitrary file download.  This may be exploited to download the encrypted 
password file in /install_dir/data/users.csv.php.


2. Insufficient filename check in admin.class.php addImage() function may allow 
arbitrary file upload.  This may be exploited by a malicious logon user to 
upload arbitrary PHP scripts instead of image files.


3. Insufficient directory traversal check in admin.class.php allows deletion of 
arbitrary directory that the Windows web server has delete access to.  On a 
Windows platform, deletion of arbitrary directories that the web server has 
write access to is possible.


4. Multiple Cross-Site Scripting (XSS) Vulnerabilities


PATCH

User are advised to upgrade to version 0.9.11.

 
DISCLOSURE TIMELINE

17 Nov 04 - Vulnerability Discovered.
17 Nov 04 - Initial Author Notification by Email.
17 Nov 04 - Initial Author Reply.
18 Nov 04 - Second Author Notification.
19 Nov 04 - Received patch from Author, but it does not work.
19 Nov 04 - Informed Author that patch does not work.
30 Nov 04 - Third Author Notification.
03 Dec 04 - Author provided fix.
15 Dec 04 - Author Released Version 0.9.11.
16 Dec 04 - Public Release.


GREETINGS

All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html 

"IT Security...the Gathering. By enthusiasts for enthusiasts."