Blue Collar Productions iGallery version 4.1 Plus suffers from an arbitrary file download vulnerability.
ac77c07cffc3f662f1b46014ede8f9f819102ed1760a4750576a5df09aeb699b
Vendor Notified: 05/25/2009
Vulnerability Details:
-------------------------------------------
Blue Collar Productions iGallery 4.1 Plus (
http://www.b-cp.com/igallery/default.asp ) is a commercial photo gallery
script written in Classic ASP. There exists also a free version
named iGallery 3.4. The file streamfile.asp suffers from an Arbitrary
File Download vulnerability due to the missed input validation on the
"i" and "f" parameters, in particular
no validation is done on path traversal patterns.
Systems Affected:
-------------------------------------------
iGallery 4.1 Plus and iGallery 3.4 were tested and shown to be vulnerable.
Impact:
-------------------------------------------
Through this vulnerability remote and unauthenticated users could
download any file
accessible by the web server and by reading source files a malicious
user could read
important information such as database passwords.
Mitigation Factors:
-------------------------------------------
New IIS installations are often configured to deny requests with ../ in
the query string. Unfortunately
the injection can come also from POST parameters.
PoC:
-------------------------------------------
http://www.example.com/igallery41/streamfile.asp?i=./../../../index.asp&f=subdir
Vendor Response:
-------------------------------------------
None as of 06/03/2009
---
Stefano Angaran
http://www.upyou.it
http://blog.upyou.it