Invision Gallery Multiple Vulnerabilities
Vendor: Invision Power Services
Product: Invision Gallery
Version: <= 1.3.1
Website: http://www.invisiongallery.com
BID: 13907
CVE: CVE-2005-1947 CVE-2005-1948
OSVDB: 17242 17243 17244
SECUNIA: 15660
PACKETSTORM: 38145
Description:
Invision Gallery is a community based gallery software that can be integrated into Invision Power Board. There are several security issues in Invision Gallery that may allow for an attacker to force a user into unknowingly / unwillingly perform actions on behalf of an attacker, or an attacker may influence SQL queries and retrieve sensitive information contained within the underlying database. An upgrade has been released for several weeks now and all users should upgrade their gallery installations as soon as possible.


Cross Site Request Forgery:
The proper precautions are not taken when dealing with certain actions, and as a result an attacker can force a user to delete images, and albums by having them simply follow a malicious link, or by including the link in an embedded tag such as img or iframe.

http://localhost/index.php?act=module&module=gallery&cmd=albums&op=del&album=2
http://localhost/index.php?act=module&module=gallery&cmd=delimg&img=2

The above links could be used to effectively delete an album and an image. This issue arises as a result of not properly adhering to RFC 2616 9.1.1


SQL Injection:
There are a couple of SQL Injection issues in Invision Gallery. The first vulnerability I will talk about presents itself when editing comments.

http://localhost/index.php?act=module&module=gallery&cmd=editcomment&comment=
-99%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,name,0,0,0%20FROM%20ibf_members%20
WHERE%201/*&img=1

The above example will select a users name from the database, but this could just as easily be a password hash. The other SQL Injection issue is pretty dangerous and presents itself when voting on a photo. Basically an attacker may include arbitrary SQL statements instead of a rating, and influence an UPDATE query which can be very dangerous.


Solution:
Updated version of the Invision Gallery software have been available for many weeks now. Users should upgrade as soon as possible. Special thanks to the guys at Invision for fixing these issues so quickly :)


Credits:
James Bercegay of the GulfTech Security Research Team