Exploit-DB #25413
Description: Wifi Photo Transfer 2.1/1.1 PRO - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-05-13
Author: Vulnerability-Lab

Exploit:
Title:
======
Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities


Date:
=====
2013-04-21


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=932


VL-ID:
=====
932


Common Vulnerability Scoring System:
====================================
6.1


Introduction:
=============
Easily access your photo libraries via wifi from any computer with a web browser! Just start the app and enter the 
displayed address into the address bar of your browser. Works with any computer that has a modern browser (like desktop 
or portable computers, iPads, or even an other iPhone) and is on the same wifi network as your phone, iPod or iPad.

- You can select and transfer multiple photos at once
- EXIF metadata is retained in mass-download mode (not in one-by-one mode)
- Optional password protection for the web interface
- Can also be used to download videos
- Transfer in full resolution or scaled down
- No extra software required

(Copy of the Homepage: #1  https://itunes.apple.com/de/app/wifi-photo-transfer-pro/id587468262)
(Copy of the Homepage: #2  https://itunes.apple.com/de/app/wifi-photo-transfer/id380326191)



Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone.


Report-Timeline:
================
2013-04-22:	Public Disclosure


Status:
========
Published


Affected Products:
==================
Apple AppStore
Product: Wifi Photo Transfer 2.1 & 1.1 Pro


Exploitation-Technique:
=======================
Remote


Severity:
=========
High


Details:
========
1.1
A local command injection web vulnerability is detected in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone. 
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.

The vulnerbility is located in the index module when processing to load the ipad or iphone device album names. Local attackers can 
change the ipad or iphone device photo album names to system specific commands and file requests to provoke the execution when 
processing to watch the main index listing. The execution of the script code occurs in the album name web context.

Exploitation of the web vulnerability does not require an application user account (standard) or user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.


Vulnerable Application(s):
				[+] Wifi Photo Transfer 2.1 & 1.1 Pro - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] Index

Vulnerable Parameter(s):
				[+] album name - iPad or iPone

Affected Module(s):
				[+] Index Listing - Album



1.2
A local file include and arbitrary file upload vulnerability is detected in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone. 
The vulnerability allows remote attackers via POST method to include unauthorized remote files on the affected webserver file system.

Remote attackers can also unauthorized implement mobile webshells by using multiple file extensions (pentest.php.js.gif) when processing to 
upload via POST request method. The attacker uploads a file with a double extension or multiple extensions and access the file in the 
secound step by usage of the directory webserver dir listing to compromise the apple iphone or ipad.

Exploitation of the local file include web vulnerability does not require user interaction and also no application user account. 
Successful exploitation of the web vulnerabilities results in app/service manipulation and ipad or iphone compromise via file 
include or unauthorized web-server file (webshell) upload attacks.


Vulnerable Application(s):
				[+] Wifi Photo Transfer 2.1 & 1.1 Pro - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] Compressing archiv to zip

Vulnerable Parameter(s):
				[+] lib  (cat)
				[+] sel  (selection)

Affected Module(s):
				[+] File Dir Album Index - Listing




1.3
An information disclosure and information leak misconfiguration is detected in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone.
The reported vulnerability allows remote attackers to access unauthorized web-server photos or web-server files by exploitation of a misconfiguration.

The secound vulnerability is located in the upload file script of the webserver (http://localhost:2323/) when processing to download with 
a manipulated POST method request all available path files. The attacker can manipulate the lib and sel values in the POST request to download 
unauthorized not accessable photo files. After the iphone or ipad user allowed one time to access the iOS photo service anybody can also 
access not implemented files from the same service folder.

Exploitation of the information disclosure web vulnerability does not require user interaction or an application user account. 
Successful exploitation of the information disclosure app vulnerability results in unauthorized photo and webserver file access.


Vulnerable Application(s):
				[+] Wifi Photo Transfer 2.1 & 1.1 Pro - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] compressprogress

Vulnerable Parameter(s):
				[+] filename

Affected Module(s):
				[+] zipdownload




1.4
A client side cross site scripting web vulnerability is detected in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone.
The vulnerability allows remote attackers to form manipulated urls to inject script code on client side application requests.

The client side cross site scripting web vulnerability is located in the path section when processing to request the images via GET with a 
manipulated filename (value) parameter. The vulnerability occurs when a remot