Ravens PHP Scripts - Invision Gallery Information Disclosure and SQL Injection

SECUNIA ADVISORY ID: SA22400

VERIFY ADVISORY: http://secunia.com/advisories/22400/

CRITICAL: Moderately critical

IMPACT: Manipulation of data, Exposure of sensitive information

WHERE: >From remote

SOFTWARE: Invision Gallery 2.x - http://secunia.com/product/6022/

DESCRIPTION: _1nf3ct0r_ has reported some vulnerabilities in Invision Gallery, which can be exploited by malicious people to disclose potentially sensitive information and conduct SQL injection attacks. The vulnerabilities are reported in version 2.0.7. Other versions may also be affected.

1) Input passed to the "dir" parameter in index.php is not properly verified before being used in a "readfile()" call.

This can be exploited to disclose the content of arbitrary files via directory traversal attacks.

2) Input passed to the "album" parameter in index.php when rating an image is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL commands.

SOLUTION: Edit the source code to ensure that input is properly verified and sanitised.

PROVIDED AND/OR DISCOVERED BY: _1nf3ct0r_