SB2017010304 - Multiple vulnerabilities in Piwigo
Published: January 3, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) PHP local file inclusion (CVE-ID: CVE-2016-10084)
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to web application does not perform insufficient sanitization of data passed through "mode" HTTP GET parameter to /admin/batch_manager.php script. A remote authenticated user can include and execute arbitrary .php file on the target system using directory traversal sequences.
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary PHP code and compromise vulnerable website.
2) PHP local file inclusion (CVE-ID: CVE-2016-10085)
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to web application does not perform insufficient sanitization of data passed through "tag" HTTP GET parameter to /admin/languages.php. A remote authenticated user can include and execute arbitrary .php file on the target system using directory traversal sequences.
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary PHP code and compromise vulnerable website.
3) PHP local file inclusion (CVE-ID: CVE-2016-10105)
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to web application does not perform insufficient sanitization of data passed through "section" HTTP GET parameter to /admin/plugin.php. A remote attacker, who is able to upload any file with PHP code inside (e.g. modified image) can execute it on the target system using directory traversal sequences.
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary PHP code and compromise vulnerable website.
4) Cross-site scripting (CVE-ID: CVE-2016-10083)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed to /admin/plugin.php script. A remote attacker can create a specially crafted web link, trick the website administrator into visiting it and execute arbitrary HTML and script code in victim’s browser in context of vulnerable website.
Successful exploitation of the vulnerability may allow an attacker to perform phishing or drive-by-download attacks, as well as steal cookies and manipulate web page content.
5) Remote code injection (CVE-ID: CVE-2016-10045)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in PHPMailer due to insufficient sanitization of user-supplied input, when Sender property is not set. A remote attacker can use backslashed double quote character (e.g. \”) to pass additional commands to original mail command and execute them with privileges of the current web server user.
Successful exploitation of the vulnerability may result in system compromise.
Note: this vulnerability exists due to incorrect fix for vulnerability SB2016122601 (CVE-2016-10033)
Remediation
Install update from vendor's website.