PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site scripting -

Advisory Content :

- PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site
scripting -

--------------------------------
software site: http://phpgraphy.sourceforge.net/
description: "Full featured photo gallery PHP script - Light, fast and easy
to
install"

vulnerable code index.php near line 503-10:

...
if ($updwelcome && isset($welcomedata) && check_welcome($dir)) {
if (strlen($welcomedata) < 10000) {

write_welcome($dir,$welcomedata);
echo "<html><script
language="javascript">window.opener.location="?dir=".rawurlencode($di
r)."";window.close();</script></html>";
} else echo "Sorry more data (10k) than allowed, protection aborting the
operation<br />";
exit;
}
...

poc, a remote user can go to this url:

http://[target]/[path]/index.php?dir=&editwelcome=1&popup=0

to have unauthorized access to some edit functionalities and to insert
html/
/javascript code or simply deface the main page

temporary patch -> replace this line:

...
if ($updwelcome && isset($welcomedata) && check_welcome($dir)) {
...

with:

...
if ($admin && $updwelcome && isset($welcomedata) && check_welcome($dir)) {
...

------------------------------------------------------------------------
--------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici.org
original advisory: http://retrogod.altervista.org/phpgraphy_0911_adv.html
------------------------------------------------------------------------
--------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

PHPGraphy <= 0.9.11 "editwelcome" unauthorized access / cross site scripting -