bugtraq - Re: [oss-security] Case YVS Image Gallery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120227213915.GA3117@foo.fgeek.fi>
Date: Mon, 27 Feb 2012 23:39:15 +0200
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: kseifried@...hat.com, corryl80@...il.com, bugtraq@...urityfocus.com
Subject: Re: [oss-security] Case YVS Image Gallery

On Mon, Feb 27, 2012 at 09:31:52AM -0700, Kurt Seifried wrote:
> If you make a list of issues (e.g. XSS, CSRF, etc) with the code
> examples I can assign the various blocks of issues CVEs.

1. ./administration/install.php opens ../functions/db_connect.php and writes to file without input validation leading to PHP code injection with all variables if any contains for example: ";} ?> <?php print("Hello World"); exit("") ?>

Note that install guide in web says: "after instalation is complete, delete the "install.php" file" and install.php does not need permissions.

2. ./administration/create_album.php does not have proper input validation leading to stored XSS, which can only be added by administrators, but I don't think this as a limit after other vulnerabilities. XSS will also be shown to normal users (mainpage).

- Henri Salo