invisionGallery.txt

`##########################################################  
# GulfTech Security Research June 9th, 2005  
##########################################################  
# Vendor : Invision Power Services  
# URL : http://www.invisiongallery.com  
# Version : All Versions Prior To 1.3.1  
# Risk : Multiple Vulnerabilities  
##########################################################  
  
  
  
Description:  
Invision Gallery is a community based gallery software that can be  
integrated into Invision Power Board. There are several security  
issues in Invision Gallery that may allow for an attacker to force  
a user into unknowingly / unwillingly perform actions on behalf of an  
attacker, or an attacker may influence SQL queries and retrieve  
sensitive information contained within the underlying database. An  
upgrade has been released for several weeks now and all users should  
upgrade their gallery installations as soon as possible.  
  
  
  
Cross Site Request Forgery:  
The proper precautions are not taken when dealing with certain actions,  
and as a result an attacker can force a user to delete images, and albums  
by having them simply follow a malicious link, or by including the link in  
an embedded tag such as img or iframe.  
  
http://localhost/index.php?act=module&module=gallery&cmd=albums&op=del&album=2  
http://localhost/index.php?act=module&module=gallery&cmd=delimg&img=2  
  
The above links could be used to effectively delete an album and an image.  
This issue arises as a result of not properly adhering to RFC 2616 9.1.1  
  
  
  
SQL Injection:  
There are a couple of SQL Injection issues in Invision Gallery. The first  
vulnerability I will talk about presents itself when editing comments.  
  
http://localhost/index.php?act=module&module=gallery&cmd=editcomment&comment=  
-99%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,name,0,0,0%20FROM%20ibf_members%20  
WHERE%201/*&img=1  
  
The above example will select a users name from the database, but this could  
just as easily be a password hash. The other SQL Injection issue is pretty  
dangerous and presents itself when voting on a photo. Basically an attacker  
may include arbitrary SQL statements instead of a rating, and influence an  
UPDATE query which can be very dangerous.  
  
  
  
Solution:  
Updated version of the Invision Gallery software have been available for  
many weeks now. Users should upgrade as soon as possible. Special thanks  
to the guys at Invision for fixing these issues so quickly :)  
  
  
  
Related Info:  
The original advisory can be found at the following location  
http://www.gulftech.org/?node=research&article_id=00079-06092005  
  
  
  
Credits:  
James Bercegay of the GulfTech Security Research Team  
`