Document Title: =============== TinyWebGallery v2.4 (TWGE) - Persistent XSS Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=1997 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16635 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16635 CVE-ID: ======= CVE-2017-16635 Release Date: ============= 2017-11-01 Vulnerability Laboratory ID (VL-ID): ==================================== 1997 Common Vulnerability Scoring System: ==================================== 4.1 Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price: ======================== 500€ - 1.000€ Product & Service Introduction: =============================== The TinyWebGallery is a free php based gallery that is very easy to install, extremely user friendly, does not need a database (uses xml files) but still has all the features you should expect and much more. The TinyWebGallery is a php photo gallery / album that is very easy to install, extremely user friendly, does not need a database (uses xml files) but still has all the features you should expect and much more. (Copy of the Homepage: http://www.tinywebgallery.com/en/overview.php ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a persistent vulnerability in the official TinyWebGallery v2.4 TWG Explorer web-application. Vulnerability Disclosure Timeline: ================================== 2017-11-01: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Michael Dempfle Product: TinyWebGallery - (TWG Explorer) Web Application 2.4 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Authentication Type: ==================== Restricted Authentication (Guest Privileges) User Interaction: ================= No User Interaction Disclosure Type: ================ Independent Security Research Technical Details & Description: ================================ A persistent cross site scripting vulnerability has been discovered in the official TinyWebGallery v2.4 TWG Explorer web-application. The persistent vulnerability allows remote attackers to inject own malicious script code to the application-side of the vulnerable service. The vulnerability is located in the `mkname`, `mkitem` and `item` parameters of the `Add/Create` module. Remote attackers with low privilege user account for backend access are able to inject malicious script codes to the `TWG Explorer` item listing. The request method to inject is POST and the attack vector is located on the application-side of the service. The injection point is the add/create input field and the execution point occurs in the item listing after the add or create. The security risk of the cross site vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.9. Exploitation of the client-side web vulnerability requires a privileged web-application user account and only low user interaction. Successful exploitation of the vulnerability results in persistent phishing, session hijacking, persistent external redirect to malicious sources and client-side manipulation of affected or connected web module context. Request Method(s): [+] POST Vulnerable Module(s): [+] TWG Explorer Vulnerable Parameter(s): [+] mkname [+] mkitem Affeced Module(s): [+] item listing index Proof of Concept (PoC): ======================= The persistent vulnerability can be exploited by remote attackers with restricted privileged accounts and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Open the tinygallery web-application 2. Login to the service with the restricted privileges 3. Open the backend section 4. Add a file oder folder by usage of the malicious test payload 5. Save the entry via POST method request Note: Now a refresh occurs to the main item listing after processing to add 6. The code executes in the list without secure parse Note: After the inject the moderator only needs to wait since the administrators visits the listing of the files/folders 7. Successful reproduce of the persistent vulnerability! PoC: Payload >"<%20%20