SecurityReason - Uphotogallery Multiple Cross-Site Scripting Vulnerability

Advisory Text :

Uphotogallery Multiple Cross-Site Scripting Vulnerability

Uphotogallery has been developed to run exclusively on web sites hosted on
Windows Servers with Internet Information Server 4.0 or higher and ASP 3.0
installed. No other Platforms are supported. Uphotogallery supports both
Microsoft Access and Microsoft Sql Server databases. This may help the
attacker steal cookie-based authentication credentials and launch other
attacks. A successful exploit could allow an attacker to compromise the
application, access or modify data, or exploit vulnerabilities in the
underlying database implementation. Cross-site request forgery, also known
as one click attack or session riding and abbreviated as CSRF or XSRF, is a
kind of malicious exploit of websites. Although similar-sounding in name to
cross-site scripting (XSS), it is a very different and almost opposite form
of attack. Whereas cross-site scripting exploits the trust a user has in a
website, a cross-site request forgery exploits the trust a Web site has in
a user by forging a request f
rom a trusted user. Compared to XSS attacks, CSRF attacks are often less
popular (so there are fewer defense resources available) and more difficult
to defend against, and thus are considered to be more dangerous.

Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Remote: Yes
Local: Yes
Class: Cross-Site Scripting

Version: Uphotogallery 1.1
vendor: www.uapplication.com

Attackers can exploit these issues via a web client.

Remote XSS:
http://xxxxxxxxxxxxxxxxxxxxxxxxxxx/path/Uphotogallery/thumbnails.asp?ci=75&
s=XSS

Local Admin:
http://xxxxxxxxxxxxxxxxxxxxxxxxxxx/path/Uphotogallery/images_archive.asp?ci
=71&s=XSS

These Pages Contail XSS Vul Forms.

- thumbnails.asp
- images_archive.asp

Demo: http://www.uapplication.com/demo/Uphotogallery/thumbnails.asp

Security researcher? Join us: mail Zinho at zinho at hackerscenter.com