e107 Plugin My_Gallery 2.3 Arbitrary File Download Vulnerability

🗓️ 26 Mar 2008 00:00:00Reported by RootType

e107 My_Gallery 2.3 Arbitrary File Download Vulnerability. Unpatched, with input validation error in dload.php, allowing disclosure of sensitive informatio


                                                e107&nbsp;My_Gallery&nbsp;Plugin&nbsp;Arbitrary&nbsp;File&nbsp;Download&nbsp;Vulnerability

Release&nbsp;Date:&nbsp;2008-03-25
Critical:&nbsp;Moderately&nbsp;critical
Impact:&nbsp;Exposure&nbsp;of&nbsp;system&nbsp;information,&nbsp;Exposure&nbsp;of&nbsp;sensitive&nbsp;information
Where:&nbsp;From&nbsp;remote
Solution&nbsp;Status:&nbsp;Unpatched
Software:&nbsp;My_Gallery&nbsp;v2.3&nbsp;(plugin&nbsp;for&nbsp;e107)
Link:&nbsp;http://plugins.e107.org/e107_plugins/psilo/psilo.php?artifact.208

Description:

A&nbsp;photo&nbsp;gallery&nbsp;for&nbsp;e107,&nbsp;powered&nbsp;by&nbsp;Highslide&nbsp;JS&nbsp;script.&nbsp;with&nbsp;random
gallery&nbsp;menu&nbsp;and&nbsp;navigation&nbsp;menu.

+&nbsp;User&nbsp;interface&nbsp;for&nbsp;uploads&nbsp;images
+&nbsp;Pre-moderation&nbsp;users&nbsp;download
+&nbsp;Control&nbsp;Panel,&nbsp;can&nbsp;edit&nbsp;the&nbsp;name&nbsp;and&nbsp;description,&nbsp;delete&nbsp;and&nbsp;move
+&nbsp;New&nbsp;comment&nbsp;system,&nbsp;it&nbsp;is&nbsp;now&nbsp;the&nbsp;most&nbsp;opulent&nbsp;gallery
+&nbsp;New&nbsp;Front&nbsp;page
+&nbsp;Added&nbsp;BBcode&nbsp;and&nbsp;a&nbsp;button

Vulnerability:
Jerome&nbsp;Athias&nbsp;has&nbsp;discovered&nbsp;a&nbsp;vulnerability&nbsp;in&nbsp;My_Gallery&nbsp;plugin&nbsp;for
e107,&nbsp;which&nbsp;can&nbsp;be&nbsp;exploited&nbsp;by&nbsp;malicious&nbsp;people&nbsp;to&nbsp;disclose&nbsp;sensitive
information.

The&nbsp;vulnerability&nbsp;is&nbsp;caused&nbsp;due&nbsp;to&nbsp;an&nbsp;input&nbsp;validation&nbsp;error&nbsp;in
dload.php&nbsp;when&nbsp;processing&nbsp;arguments&nbsp;passed&nbsp;to&nbsp;the&nbsp;&quot;file&quot;&nbsp;parameter.&nbsp;This
can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;download&nbsp;arbitrary&nbsp;files&nbsp;from&nbsp;the&nbsp;affected&nbsp;system.

The&nbsp;vulnerability&nbsp;is&nbsp;confirmed&nbsp;in&nbsp;version&nbsp;2.3.&nbsp;Other&nbsp;versions&nbsp;may&nbsp;also
be&nbsp;affected.

Solution:
Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;validated.

Dork:&nbsp;inurl:&quot;e107_plugins/my_gallery&quot;

Provided&nbsp;and/or&nbsp;discovered&nbsp;by:
Jerome&nbsp;Athias,&nbsp;JA-PSI
http://www.ja-psi.fr

Other&nbsp;References:
https://www.securinfos.info


------------------------------------------------------------------
PoC:
http://target.com/e107_plugins/my_gallery/dload.php?file=dload.php

File&nbsp;is&nbsp;downloaded&nbsp;as&nbsp;a&nbsp;.jpg&nbsp;file&nbsp;but&nbsp;the&nbsp;PHP&nbsp;source&nbsp;code&nbsp;can&nbsp;be
retrieved&nbsp;using&nbsp;a&nbsp;text&nbsp;editor.

26 Mar 2008 00:00Current

7.1High risk

Vulners AI Score7.1