Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 25 Jul 2016 10:54:07 -0400
From: "Larry W. Cashdollar" <>
To: Open Source Security <>
Subject: Huge-IT Portfolio Gallery manager v1.1.5 SQL Injection and XSS

Title: Huge-IT Portfolio Gallery manager v1.1.5 SQL Injection and XSS
Author: Larry W. Cashdollar, @_larry0
Date: 2016-07-15
Download Site:
Vendor: Huge IT
Vendor Notified: 2016-07-16
Vendor Contact:
Description: Huge-IT Portfolio Gallery extension can do wonders with your website. If you wish to show your photos, videos, enclosing the additional images and videos, then this Portfolio Gallery extension is what you need.
The attacker must be logged in with at least manager level access or access to the administrative panel to exploit this vulnerability:

XSS line 156 in : ./administrator/components/com_portfoliogallery/views/video/tmpl/default.php

155                         <textarea rows="3" cols="50" class="text-area" disab    led >
156                     <?php echo $_GET['edit'];?>
157                         </textarea>

In file administrator/components/com_portfoliogallery/models/portfoliogallery.php:  

variable id is passed without any sanitization to the SQL query being built starting at line 53:

 50     public function getPropertie() {
 51         $db = JFactory::getDBO();
 52         $id_cat = JRequest::getVar('id');
 53         $query = $db->getQuery(true);
 54         $query->select(' as name,'
 55                 . ' ,'
 56                 . ' as portName,'
 57                 . 'portfolio_id,#__huge_itportfolio_images.category as categ    ory, #__huge_itportfolio_images.description as description,image_url,sl_url,    sl_type,link_target,#__huge_itportfolio_images.ordering,#__huge_itportfolio_    images.published,published_in_sl_width');
 58         $query->from(array('#__huge_itportfolio_portfolios' => '#__huge_itpo    rtfolio_portfolios', '#__huge_itportfolio_images' => '#__huge_itportfolio_im    ages'));
 59         $query->where(' = portfolio_id')->w    here('portfolio_id=' . $id_cat);
 60         $query->order('ordering asc');
 61         $db->setQuery($query);
 62         $results = $db->loadObjectList();
 63         return $results;

CVE-2016-1000115 XSS
CVE-2016-1000116 SQLi

Exploit Code:
	• sqlmap  --load-cookies=cookies.txt -u "*" --dbms mysql --dump

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.