bugtraq - imageVue16.1 upload vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 11 Feb 2006 14:58:56 -0000
From: zjieb@...mail.com
To: bugtraq@...urityfocus.com
Subject: imageVue16.1 upload vulnerability

ImageVue is an online Flash gallery for viewing images. For more information about ImageVue visit http://www.imagevuex.com

Credits: me

Vulnerable Systems:
imageVue16.1

In ImageVue one can upload images to the Gallery. The upload-script however isn't checking credentials nor does it check file extensions i.e. it's possible for any user to upload any file as long as the 'right' permissions have been set for the uploading folder.

Exploit:
1) check folder permissions
http://[target]/dir.php
An XML-document is shown containing all folders and their permissions.
2) upload a file to a folder from the XML
http://[target]/admin/upload.php?path=../[foldername]
Now you're ready to upload any file.

Other vulnerabilities:
1) view dir listings
http://[target]/readfolder.php?path=[path]&ext=[extension]
2) querystring is passed to style and body
http://[target]/index.php?bgcol=[input]