Multiple vulnerabilities have been discovered in the GRAND FlAGallery plugin for WordPress, which can be exploited by malicious users to conduct SQL injection attacks and compromise a vulnerable system and by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "settingsXML" parameter in wp-content/plugins/flash-album-gallery/admin/skin_options.php (when "properties_skin" is set and "mainXML" is set to desired php code) is not properly verified in admin/skin_options.php before being used to write to a file. This can be exploited to save and execute arbitrary PHP code using directory traversal sequences.

Successful exploitation of this vulnerability requires "Editor" with "Change skin" privilege.

2) Input passed via the "album_id" POST parameter to wp-content/plugins/flash-album-gallery/admin/ajax.php (when "action" is set to "flag_save_album" and "album_name" is set) is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires "Editor" with "Manage gallery" privilege.

3) Input passed to the "orderby" parameter of the flagallery shortcode (when "gid" is set to "all") while creating a new post is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires privilege to create a post.

The vulnerabilities #1 through #3 are confirmed in version 2.00. Other versions may also be affected.

4) The vulnerability is caused due to a bundled vulnerable version of swfupload.

For more information:
SA49651

This vulnerability is confirmed in version 2.11. Other versions may also be affected.

Solution
Update to version 2.17.

Provided and/or discovered by
1-3) Janek Vind "waraxe"
4) Reported by the vendor

Changelog
Further details available to Secunia VIM customers

Original Advisory
GRAND FlAGallery:
http://wordpress.org/extend/plugins/flash-album-gallery/changelog/

Janek Vind "waraxe":
http://www.waraxe.us/advisory-94.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers