Multiple vulnerabilities in Piwigo

1) PHP local file inclusion

EUVDB-ID: #VU3123

Risk: Medium

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10084

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to web application does not perform insufficient sanitization of data passed through "mode" HTTP GET parameter to /admin/batch_manager.php script. A remote authenticated user can include and execute arbitrary .php file on the target system using directory traversal sequences.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary PHP code and compromise vulnerable website.

Mitigation

Update to version 2.8.5.

Vulnerable software versions

Piwigo: 2.8.0 - 2.8.4

External links

http://piwigo.org/releases/2.8.5
http://github.com/Piwigo/Piwigo/issues/572

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) PHP local file inclusion

EUVDB-ID: #VU3122

Risk: Medium

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10085

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to web application does not perform insufficient sanitization of data passed through "tag" HTTP GET parameter to /admin/languages.php. A remote authenticated user can include and execute arbitrary .php file on the target system using directory traversal sequences.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary PHP code and compromise vulnerable website.

Mitigation

Update to version 2.8.5.

Vulnerable software versions

Piwigo: 2.8.0 - 2.8.4

External links

http://piwigo.org/releases/2.8.5
http://github.com/Piwigo/Piwigo/issues/573

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) PHP local file inclusion

EUVDB-ID: #VU3121

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10105

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to web application does not perform insufficient sanitization of data passed through "section" HTTP GET parameter to /admin/plugin.php. A remote attacker, who is able to upload any file with PHP code inside (e.g. modified image) can execute it on the target system using directory traversal sequences.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary PHP code and compromise vulnerable website.

Mitigation

Update to version 2.8.5.

Vulnerable software versions

Piwigo: 2.8.0 - 2.8.4

External links

http://piwigo.org/releases/2.8.5
http://github.com/Piwigo/Piwigo/issues/574

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cross-site scripting

EUVDB-ID: #VU3120

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10083

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to /admin/plugin.php script. A remote attacker can create a specially crafted web link, trick the website administrator into visiting it and execute arbitrary HTML and script code in victim’s browser in context of vulnerable website.

Successful exploitation of the vulnerability may allow an attacker to perform phishing or drive-by-download attacks, as well as steal cookies and manipulate web page content.

Mitigation

Update to version 2.8.5.

Vulnerable software versions

Piwigo: 2.8.0 - 2.8.4

External links

http://piwigo.org/releases/2.8.5
http://github.com/Piwigo/Piwigo/issues/575

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Remote code injection

EUVDB-ID: #VU3119

Risk: High

CVSSv3.1: 9.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2016-10045

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in PHPMailer due to insufficient sanitization of user-supplied input, when Sender property is not set. A remote attacker can use backslashed double quote character (e.g. \”) to pass additional commands to original mail command and execute them with privileges of the current web server user.

Successful exploitation of the vulnerability may result in system compromise.

Note: this vulnerability exists due to incorrect fix for vulnerability SB2016122601 (CVE-2016-10033)

Mitigation

Update to version 2.8.5, which includes fixed version of PHPMailer 5.2.21.

Vulnerable software versions

Piwigo: 2.8.0 - 2.8.4

External links

http://github.com/Piwigo/Piwigo/pull/595
http://piwigo.org/releases/2.8.5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.