=========================================================== Yapig: XSS / Code Injection Vulnerability =========================================================== Technical University of Vienna Security Advisory TUVSA-0510-001, October 13, 2005 =========================================================== Affected applications ---------------------- Yapig (yapig.sourceforge.net) Versions 0.95b and prior. Description ------------ 1.) Stored XSS An attacker can include malicious JavaScript by posting an image-related comment and inserting something like the following into the "Homepage" form field: "><script>alert('hi')</script> This attack falls under the category of stored cross-site scripting and doesn't require the attacker to be logged in. 2.) Reflected XSS An attacker can include malicious JavaScript by tricking a user into clicking a link to the following URL: http://your-server/path-to-yapig/view.php?gid=1&phid=1&img_size=><script >alert('hi')</script> The fields "your-server" and "path-to-yapig" in the given URL have to be adjusted accordingly. The parameters "gid=1" and "phid=1" assume that there exist a gallery and a photo with ID 1 and can be adjusted as well. Moreover, the width of the image being viewed has to be less than $MAX_IMG_SIZE (set inside config.php) because otherwise, the vulnerable variable $img_size is set to a safe value inside the if-branch on line 120 of view.php. And finally, register_globals has to be active. 3.) Code Injection An attacker can inject arbitrary PHP code into a gallery's "guid_info.php" file by tricking the logged-in admin into clicking a link to a page with the following contents: <form method="post" action="http://your-server/path-to-yapig/yapig095b/modify_gallery.php?ac tion=mod_info&gid=1"> <input value='TestGallery"; echo "evil' name="title" type="text"> <input value="TestAuthor" name="author" type="text"> <input value="TestDate" name="date" type="text"> <input value="" name="dir" type="text"> <input value="TestDescription" name="desc" type="text"> <input type="submit"> </form> <script type="text/javascript"> document.forms[0].submit(); </script> As for vulnerability #2, "your-server", "path-to-yapig", "gid" and "phid" can be adjusted. Apart from this, Yapig seems to be susceptible to "Cross-Site Request Forgery" (CSRF) attacks in general. However, this problem is not limited to Yapig, but affects a large number of comparable web applications available at this time. Solution --------- Attempts to contact the authors were not successful until now, so there is no official solution available yet. Timeline: September 28, 2005: Attempt to contact Yapig developers via "natasab at users.sourceforge.net". October 5, 2005: Attempt to contact Yapig developers via Sourceforge bug tracker. October 13, 2005: Advisory submission. Nenad Jovanovic Secure Systems Lab Technical University of Vienna www.seclab.tuwien.ac.at