BID:11990

Singapore Image Gallery Multiple Remote Vulnerabilities

Info

Singapore Image Gallery Multiple Remote Vulnerabilities

Bugtraq ID:	11990
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2004 12:00AM
Updated:	Dec 16 2004 12:00AM
Credit:	Discovery is credited to Tan Chew Keong.
Vulnerable:	singapore singapore 0.9.10 beta singapore singapore 0.9.10 singapore singapore 0.9.9 b beta singapore singapore 0.9.9 a beta singapore singapore 0.9.8 beta singapore singapore 0.9.7 beta singapore singapore 0.9.6 beta singapore singapore 0.9.5 beta singapore singapore 0.9.4 beta singapore singapore 0.9.3 beta singapore singapore 0.9.2 beta singapore singapore 0.9.1 beta singapore singapore 0.9 a beta singapore singapore 0.9 beta

Not Vulnerable:	singapore singapore 0.9.11 beta

Discussion

Singapore Image Gallery Multiple Remote Vulnerabilities

Singapore is prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied input and may allow remote attackers to carry out directory traversal, file upload, and cross-site scripting attacks.

An attacker may disclose files from a vulnerable server by issuing a malicious HTTP GET request containing directory traversal sequences.

The application is affected by an arbitrary script upload vulnerability.

An attacker can delete arbitrary files from a vulnerable computer.

The application is also vulnerable to multiple unspecified cross-site scripting issues.

Singapore 0.9.10 and prior versions are believed to be vulnerable to these vulnerabilities.

Exploit / POC

Singapore Image Gallery Multiple Remote Vulnerabilities

An exploit is not required to leverage these issues.

Solution / Fix

Singapore Image Gallery Multiple Remote Vulnerabilities

Solution:
The vendor has released singapore 0.9.11 beta to address these issues:

singapore singapore 0.9 a beta