AresU Advisory 04/27/2003 Album.pl Vulnerability Severity : High (CGI Remote Command Execution) Systems Affected: Album.pl up to v6.1 Vendor URL: http://perl.bobbitt.ca/album Vuln Type : CGI Remote Command Execution Status : Vendor contacted, new fixed version available Author : AresU Greetz to : Mike B., Bosen, Tioeuy, syzwz, Heltz, eF73, SakitJiwa, nimdA, Br0374l, FreshFirst, Algorithm All 1ndonesian Security Team (1st) http://www.bosen.net/releases/ http://bosen.blogspot.com Summary ======= album.pl is a popular web photo album application that allows you to simply drop new photo files into a directory, and they will automatically be accessible via the web. Any user can execute commands with Web Server privileges (normally nobody) when use an alternate configuration file. Solution ======== Upgrade to a newer album.pl version (at least 6.2) http://perl.bobbitt.ca/album/album62.zip Acknowledgments =============== Vulnerability discovery and advisory by AresU Vendor Response =============== Vendor has been contacted and new fixed version is available. Exploit Code ============ I have refrained from publishing a more functional exploit at this time, to delay attacks against album.pl installations. ----------------------------------------------- This mail sent through http://webmail.bosen.net