Re: [oss-security] Case YVS Image Gallery

[Henri Salo <henri@xxxxxxx>]

On Mon, Feb 27, 2012 at 09:31:52AM -0700, Kurt Seifried wrote:
> If you make a list of issues (e.g. XSS, CSRF, etc) with the code
> examples I can assign the various blocks of issues CVEs.

1. ./administration/install.php opens ../functions/db_connect.php and writes to 
file without input validation leading to PHP code injection with all variables 
if any contains for example: ";} ?> <?php print("Hello World"); exit("") ?>

Note that install guide in web says: "after instalation is complete, delete the 
"install.php" file" and install.php does not need permissions.

2. ./administration/create_album.php does not have proper input validation 
leading to stored XSS, which can only be added by administrators, but I don't 
think this as a limit after other vulnerabilities. XSS will also be shown to 
normal users (mainpage).

- Henri Salo