The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
singapore Image Gallery Web Application Multiple Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://singapore.sourceforge.net/> singapore is "yet another open source
PHP based image gallery web application. What makes it different from the
hundreds of other similar scripts is that it is specifically geared
towards displaying art in an aesthetically pleasing fashion using a clean,
uncluttered interface".
Multiple vulnerabilities were found in the singapore Image Gallery Web
application including arbitrary file download, directory deletion and
Cross-Site Scripting (XSS).
DETAILS
Vulnerable Systems:
* singapore Image Gallery Web Application version 0.9.10
Immune Systems:
* singapore Image Gallery Web Application version 0.9.11
1. Insufficient checks to prevent directory traversal in thumb.php
showThumb() method allows arbitrary file download. This may be exploited
to download the encrypted password file in
/install_dir/data/users.csv.php.
2. Insufficient filename checks in admin.class.php addImage() function may
allow arbitrary file upload. This may be exploited by a malicious logon
user to upload arbitrary PHP scripts instead of image files.
3. Insufficient checks to prevent directory traversal in admin.class.php
allow deletion of arbitrary directory that the scripts has delete access
to. On a Windows platform, deletion of arbitrary directories that the web
server has write access to is also possible.
4. Multiple Cross-Site Scripting (XSS) Vulnerabilities
Disclosure Timeline:
17 Nov 04 - Vulnerability Discovered.
17 Nov 04 - Initial Author Notification by Email.
17 Nov 04 - Initial Author Reply.
18 Nov 04 - Second Author Notification.
19 Nov 04 - Received patch from Author, but it does not work.
19 Nov 04 - Informed Author that patch does not work.
30 Nov 04 - Third Author Notification.
03 Dec 04 - Author provided fix.
15 Dec 04 - Author Released Version 0.9.11.
16 Dec 04 - Public Release.
ADDITIONAL INFORMATION
The information has been provided by <mailto:chewkeong@security.org.sg>
Tan Chew Keong.
The original article can be found at:
<http://www.security.org.sg/vuln/singapore0910.html>
http://www.security.org.sg/vuln/singapore0910.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
