VULHUB ™

STinyWebGallery（TWG）是软件开发者Michael Dempfle所研发的一套基于Ajax、PHP和XML的开源相册，它提供文字和图片水印、幻灯片播放、图像上传和管理等功能。 TinyWebGallery的/admin/_include/init.php模块没有正确地验证用户请求中的$_GET['lang']参数： 110. // Get Language 111. if (isset($GLOBALS['__GET']["lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"] = $GLOBALS['__GET']["lang"]; 112. elseif (isset($GLOBALS['__POST']["lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"] = $GLOBALS['__POST']["lang"]; 113. else if (isset($_SESSION["admin_lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"]; 114. else $GLOBALS["language"] = $GLOBALS["default_language"]; 115. [...] 138. 139. // ------------------------------------------------------------------------------ 140. // Necessary files 141. require _QUIXPLORER_PATH . "/_config/conf.php"; 142. 143. if (file_exists(_QUIXPLORER_PATH . "/_lang/" . $GLOBALS["language"] . ".php")) 144. require _QUIXPLORER_PATH . "/_lang/" . $GLOBALS["language"] . ".php"; 145....

STinyWebGallery（TWG）是软件开发者Michael Dempfle所研发的一套基于Ajax、PHP和XML的开源相册，它提供文字和图片水印、幻灯片播放、图像上传和管理等功能。 TinyWebGallery的/admin/_include/init.php模块没有正确地验证用户请求中的$_GET['lang']参数： 110. // Get Language 111. if (isset($GLOBALS['__GET']["lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"] = $GLOBALS['__GET']["lang"]; 112. elseif (isset($GLOBALS['__POST']["lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"] = $GLOBALS['__POST']["lang"]; 113. else if (isset($_SESSION["admin_lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"]; 114. else $GLOBALS["language"] = $GLOBALS["default_language"]; 115. [...] 138. 139. // ------------------------------------------------------------------------------ 140. // Necessary files 141. require _QUIXPLORER_PATH . "/_config/conf.php"; 142. 143. if (file_exists(_QUIXPLORER_PATH . "/_lang/" . $GLOBALS["language"] . ".php")) 144. require _QUIXPLORER_PATH . "/_lang/" . $GLOBALS["language"] . ".php"; 145. else if (file_exists(_QUIXPLORER_PATH . "/_lang/" . $GLOBALS["default_language"] . ".php")) 146. require _QUIXPLORER_PATH . "/_lang/" . $GLOBALS["default_language"] . ".php"; 147. else 148. require _QUIXPLORER_PATH . "/_lang/en.php"; 远程攻击者可以通过在144行的require函数包含任意文件。成功攻击要求magic_quotes_gpc = off。