Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Invision Gallery Input Validation Bugs in 'cmd' and 'show' Parameters Permit SQL Injection and Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1013894
|
|
SecurityTracker URL: http://securitytracker.com/id?1013894
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 5 2005
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Description: ComSec from governmentsecurity.org reported a vulnerability in Invision Gallery. A remote authenticated user can inject SQL commands. A remote user can conduct cross-site scripting attacks.
The 'gallery' module does not properly validate user-supplied input in the 'show' parameter. A remote authenticated user can submit
a specially crafted parameter value to execute SQL commands on the underlying database.
A demonstration exploit URL is provided:
http://[target]/v2/index.php?act=mo
dule&module=gallery&cmd=slideshow&show='><script>alert(document.cookie)</script>
A remote user can also create a specially crafted
URL that, when loaded by an authenticated target user with Internet Explorer, will cause arbitrary scripting code to be executed
by the target user's browser. The code will originate from the site running the Invision Gallery software and will run in the security
context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies),
if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on
the site acting as the target user.
A demonstration exploit URL is provided:
http://[target]/v2/index.php?act=module&module=gallery&cmd=\'><script>alert(document.co
okie)</script>
|
Impact: A remote authenticated user can execute SQL commands on the underlying database.
A remote user can access the target user's cookies
(including authentication cookies), if any, associated with the site running the Invision Gallery software, access data recently
submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.invisiongallery.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "ComSec" <deadlink@elitemail.org>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 04 May 2005 03:16:43 -0700
From: "ComSec" <deadlink@elitemail.org>
Subject: Invision Gallery XSS error message table and cookie , session details
|
hi SecurityTracker
just to let you know if your interested some more issues involving
Invision Products
http://www.invisiongallery.com
about:Invision Gallery is a fully featured, powerful gallery system that
is easy and fun to use! It plugs right into your existing Invision Power
Board to create a seamless browsing experience for the users of your
forum. We've taken many of the most popular feature requests from our
customers and integrated them into this product.
Target URL:http://demo.invisionboard.com/v2/?act=module&module=gallery
LOGIN AS :
U:demo
P:demo
a couple of issues apply:
by adding script injection inputs like so
http://demo.invisionboard.com/v2/index.php?act=module&module=gallery&cmd=slideshow&show='><
script>alert(document.cookie)</script>&duration='><script>alert(document.cookie
)</script>&sort_key=date&order_key=DESC&prune_key=30&cat=1
will cause an injection error messages
[CODE]mySQL query error: SELECT i.file_type, i.masked_file_name,
i.caption, i.id, i.directory, m.name, m.id AS mid
FROM ibf_gallery_images i, ibf_members m
WHERE album_id=0 AND m.id=i.member_id
ORDER BY date DESC
LIMIT
'><script>alert(document.cookie)</script>
,
1[/CODE]
with the above info you can then navigate the table... using the SELECT
FROM WHERE ORDER LIMIT....
also cookie and session can be obtained with :
http://demo.invisionboard.com/v2/index.php?act=module&module=gallery&cmd=\'><script>
alert(document.cookie)</script>
No response from previous issues from vendor , hence vendor NOT informed
screenshots:
www.how-to-hack.org/error.jpg
www.how-to-hack.org/gal.jpg
regards:
--
ComSec
http://www.governmentsecurity.org/forum
http://www.how-to-hack.org
|
|
Go to the Top of This SecurityTracker Archive Page
|
