Linuxfreund schrieb:

Moin,

bekommt man in diesem Forum eigentlich Feedback auf gemeldete Fehler?

manchmal ...

wobei es bei Fehlermeldungen mehr Sinn macht, diese im Englischen Piwigoforum zu posten, da sich dort die Programmierer aufhalten (von denen nur wenige hier regelmäßig reinschauen)

Hallo,

ich habe die aktuellste Piwigo-Versoin installiert und bin nach wie vor begeistert von der Anwendung.

Heute habe ich meinen Weberver mal einem Security-Scan unterzogen (https://freescan.qualys.com) und das Ergebnis zeigt einige Schwachstellen auf. Kritisch eingestuft werden 3x SQL-Injection und 1x XSS.

Falls der Scan kein false-positive ausgeworfen hat, lässt sich die Anwendung wahrscheinlich noch ein wenig besser machen ;-).

Viele Grüße
Linuxfreund

Hier die Ausgabe des Security-Scans

**** SQL-Injection 1 ****
https://****.de/piwigo/comments.php?keyword=1&author=1&sort_by=date&cat=0&sort_order=DESC&since=4&items_number=1e309 -- <pre>
Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1e309 OFFSET 0' at line 24

SELECT SQL_CALC_FOUND_ROWS com.id AS comment_id,
       com.image_id,
       ic.category_id,
       com.author,
       com.author_id,
       u.mail_address AS user_email,
       com.email,
       com.date,
       com.website_url,
       com.content,
       com.validated
  FROM piwigo_image_category AS
 
**** SQL-Injection 2 ****
https://****.de/piwigo/comments.php?keyword=1&author=1&sort_by=date&cat=0&sort_order=DESC&since=1e309&items_number=10 -- 194
<pre>
Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND validated='true'
    AND  (category_id NOT IN (3,2,4,5))
  GROUP BY comment_' at line 20

SELECT SQL_CALC_FOUND_ROWS com.id AS comment_id,
       com.image_id,
       ic.category_id,
       com.author,
       com.author_id,
       u.mail_address AS user_email,
       com.email,
       com.date,
       com.website_url,
      

**** SQL-Injection 3 ****
https://****.de/piwigo/search_rules.php?search_id=1e309 -- <pre>
Warning: [mysql error 1367] Illegal double '1e309' value found during parsing

SELECT rules
  FROM piwigo_search
  WHERE id = 1e309
; in /var/www/html/****.de/piwigo/include/dblayer/functions_mysqli.inc.php on line 830
</pre>
Fatal error: Call to a member function fetch_row() on a non-object in /var/www/html/****.de/piwigo/include/dblayer/functions_mysqli.inc.php on line 216
,https://home.****.de/piwigo/search_rules.php?search_id=1e309 -- <pre>
Warning: [mysql error 1367] Illegal double '1e309' value found during parsing

SELECT rules
  FROM piwigo_search
  WHERE id = 1e309
; in /var/www/html/****.de/piwigo/include/dblayer/functions_mysqli.inc.php on line 830
</pre>
Fatal error: Call to a member function fetch_row() on a non-object in /var/www/html/****.de/piwigo/include/dblayer/functions_mysqli.inc.php on line 216


**** XSS ****
null --


<p class="search_results">Keine Ergebnisse für :
    <em><strong>
        z--><qss>
    </strong></em>
</p>









</div>
<div id="copyright">


  Betrieben durch    <a href="http://de.piwigo.org" class="Piwigo">Piwigo</a>
 
    <!--
parsed: z--><qss>
1 tokens
z--><qss>: 0 tags, 0 tiids, 0 iiids, 0 iids modifier:0
before perms 0
-->
</div>

</div>

<!-- BEGIN get_combined -->
<script type="text/javascript" src="_data/combined/brjvyq.js"></script>
<script type="text/javascript">//<![CDATA[

var ,null -- comment: A significant portion of the XSS test payload appeared in the web page, but the page's DOM was not modified as expected for a successful exploit. This result should be manually verified to determine its accuracy.

">Keine Ergebnisse für :
    <em><strong>
        "'><qss a=X164249272Y1Z>
    </strong></em>
</p>









</div>
<div id="copyright">


  Betrieben durch    <a href="http://de.piwigo.org" class="Piwigo">Piwigo</a>
 
    <!--
parsed: "'><qss a=X164249272Y1Z>"
1 tokens
"'><qss a=X164249272Y1Z>": 0 tags, 0 tiids, 0 iiids, 0 iids modifier:1
before perms 0
-->
</div>

</div>

<!-- BEGIN get_combined -->
<script type="text/javascript" src="_data/combined/brjvyq.js"></script>
<script type="text/java