Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in TinyWebGallery version 2.5. Authenticated attackers can inject malicious JavaScript code into the folder name parameter by editing album folder names. The injected script is stored and later executed when other users view the affected gallery pages, allowing arbitrary JavaScript execution in the victim's browser. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to execution of arbitrary JavaScript in the context of other users' browsers when they view the affected gallery pages. This can result in session hijacking, defacement, or other malicious actions that compromise user interactions and security. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can check for album folder names containing suspicious script tags or JavaScript code injections. One approach is to log in as an authenticated user and inspect the folder name fields for injected scripts. For example, you can use curl or similar tools to send a POST request to the endpoint `/twg25/i_frames/i_titel.php` with parameters including `twg_foldername` containing script tags, and observe if the input is stored and executed. Additionally, manually reviewing the folder names in the gallery pages for script tags can help identify exploitation. Example command to test injection: curl -X POST -d 'twg_foldername=<script>alert(4)</script>' http://your-twg-url/twg25/i_frames/i_titel.php -H 'Cookie: your_auth_cookie'. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting folder name inputs to disallow script tags or any HTML/JavaScript code by implementing proper input validation and sanitization on the server side. Ensure that user inputs are properly escaped before storage and rendering. Additionally, limit privileges of authenticated users to reduce the risk of malicious input. Applying updates or patches from the vendor when available is recommended. As a temporary measure, monitor and remove any folder names containing suspicious scripts to prevent execution. [1, 3]

Useful 0 Not Useful 0