TITLE:
YaPiG Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA17041

VERIFY ADVISORY:
http://secunia.com/advisories/17041/

CRITICAL:
Moderately critical

IMPACT:
Hijacking, Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
YaPiG 0.x
http://secunia.com/product/3795/

DESCRIPTION:
Nenad Jovanovic has discovered some vulnerabilities in YaPiG, which
can be exploited by malicious people to conduct cross-site scripting,
script insertion, and cross-site request forgery attacks.

1) Input passed to the "Website" field when adding a comment is not
properly sanitised before being used. This can be exploited to inject
arbitrary HTML and script code, which will be executed in a user's
browser session in context of an affected site when the malicious
comment is viewed.

2) Input passed to the "img_size" parameter in "view.php" isn't
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of a vulnerable site.

Successful exploitation requires that "register_globals" is enabled.

3) An error caused due to the application allowing users to perform
certain actions via HTTP POST requests without performing any
validity checks to verify the user's request, can be exploited to
perform certain administrative tasks.

This can further be exploited to inject arbitrary PHP code into the
"guid_info.php" file via the "title" field when modifying a gallery.

The vulnerabilities have been confirmed in version 0.95b. Prior
versions are reportedly also affected. Other versions may also be
affected.

SOLUTION:
Edit the source code to ensure that input is properly verified and
sanitised.

PROVIDED AND/OR DISCOVERED BY:
Nenad Jovanovic, Secure Systems Lab, Technical University of Vienna

ORIGINAL ADVISORY:
http://www.seclab.tuwien.ac.at/advisories/TUVSA-0510-001.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------