bugtraq - ImageFolio All Versions : admin.cgi Directory transversal and file delete exploit.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004d01c32b05$53bd94b0$0301a8c0@amphetamins>
Date: Thu, 5 Jun 2003 13:53:57 +1200
From: "Paul Craig" <pimp@...inwave.net.nz>
To: <bugtraq@...urityfocus.com>
Subject: ImageFolio All Versions             : admin.cgi Directory transversal and file delete exploit.

    /----------------------------
            Pimp industries. 
    -----------------------------/

 ImageFolio All Versions  : admin.cgi Directory transversal and file
delete exploit.
 Company: www.imagefolio.com

Background
-------------
ImageFolio is a multi-platform, server-based, software product suite
that fully automates the process of viewing, publishing, maintaining,
distributing, archiving, and marketing your Web-based multimedia gallery
or store. ImageFolio supports all media types, including images, video,
and sound. 

Exploit:
-------------

The exploit occurs inside admin.cgi found usually in
/cgi-bin/ImageFolio/admin/admin.cgi.
Once the admin has logged in you can use the remove function to delete
media, however no checking for
../ is done so it is very easy to simply traverse back through the file
system.
This not only allows you to list the contents of files in directories
but also remove any file as the user the web server is running as.
Usually this would be limited by the fact you have to be authenticated
as an Admin user, but since the default username/password of
Admin/ImageFolio exists on a lot of servers in the wild (default
account).Tisk Tisk.
Always change the default username/password!

Example

http://www.samplesite.com/cgi-bin/imagefolio/admin/admin.cgi?cgi=remove.
pl&uid=111.111.111.111&rmstep=2&category=../../../../../../../../../../.
./etc/

Suggestions/Work Around:
-------------
BizDesign were contacted and have issued a fix that can be found at
http://www.imagefolio.com/ubb/Forum25/HTML/000019.html
I would like to thank BizDesign for being so prompt on fixing this flaw.

Greets
-------------
archive, decx, Mark Burnett, *.nz and anyone with more than two brain
cells..
Oh and most of all you.

Paul Craig
Security Researcher
Pimp Industries

"He who laughs last thinks slowest!"