Title: ====== Reserve Logic v1.2 Booking CMS - Multiple Vulnerabilities Date: ===== 2012-06-18 References: =========== http://www.vulnerability-lab.com/get_content.php?id=617 VL-ID: ===== 617 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= iScripts ReserveLogic offers an online web based reservation system for the hospitality industry for service providers. This turn-key reservation system allows you to start online reservation and customer management in minutes. Flexible Reservation Software. iScripts ReserveLogic is designed to simplify the task of online booking. It provides users a unique, intuitive and easy to use interface that improves the way people use the web today. Through personalization and rich features, iScripts ReserveLogic enhances the entire Web experience. Online Reservation system for: - Hotel reservation - Motel reservation - Time share booking - Bed and Breakfasts - Vacation Rental - Resort reservation - Camp grounds - Tour and Travel Company - Open source script – No encryption - Multiple themes and layouts - Highly scalable - Easy to install using an install wizard - Easy to use interface - Powerful administration panel - Easy to customize iScripts ReserveLogic can help you set up an online hotel reservation system at a very affordable price. We also provide updates and free technical support for one year. This online reservation script is designed to improve the conversion of your website visitors and transform them into your own customers. ReserveLogic works to increase your sales around the clock. This open source PHP software is very scalable; it supports multiple destinations and multiple properties. So if you have a bed and breakfast, hotel, motel, or a multi destination and property resort chain, our company’s reservation software will serve your needs. (Copy of the Vendor Homepage: http://www.iscripts.com/reservelogic/ ) Abstract: ========= The Vulnerability Laboratory Research Team discovered multiple different web vulnerabilites in iScripts Reserve Logic v1.2 Booking CMS. Report-Timeline: ================ 2012-04-18: Public or Non-Public Disclosure Status: ======== Published Affected Products: ================== iScripts Product: Reserve Logic (Booking) CMS v1.2 Exploitation-Technique: ======================= Remote Severity: ========= Critical Details: ======== 1.1 Multiple remote blind and standard SQL Injection vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking CMS. The vulnerability allows an attacker (remote) to inject/execute own sql commands on the affected application dbms. The vulnerabilities are located in the packagedetails.php, booking_report.php, users_report.php, editenquiries.php, addclientlocations.php, addcustomers.php, addaccomtypeavailability.php, addspecialoffer.php & booking_report.php files. The vulnerable bound parameters of the files are id, rghtMenu, pid & oderby. Successful exploitation of the vulnerability results in dbms, service & application compromise. Vulnerable Files(s): [+] packagedetails.php [+] booking_report.php [+] users_report.php [+] editenquiries.php [+] addclientlocations.php [+] addcustomers.php [+] addpackages.php [+] addaccomtypeavailability.php [+] booking_report.php [+] addspecialoffer.php Vulnerable Parameter(s): [+] id [+] rghtMenu [+] pid [+] orderby 1.2 A arbitrary file upload vulnerability is detected in iScripts Reserve Logic v1.2 Booking Content Management System. The vulnerability allows a privileged user account to upload malicious files without restriction. The uploaded files are not parsed & attackers can also upload for example web shells and access them out of the unrestricted web folder. The vulnerability is located in the addlocationphotos.php (image) file. The input get saved to the unrestricted ../galleryimages/ application path. Successful exploitation of the vulnerability result in an arbitrary file upload. Vulnerable Files(s): [+] addlocationphotos.php Vulnerable Module(s): [+] ../galleryimages/ 1.3 Multiple persistent input validation vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking Content Management System. The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent). The persistent vulnerabilities are located in the addpackages.php, add_news.php, add_banner.php or addaccomtypeavailability.php with the bound vulnerable parameters title & name. Exploitation requires low user inter action & privileged application user account. Successful exploitation of the vulnerability can lead to session hijacking (admin) or stable (persistent) context manipulation. Vulnerable Files(s): [+] addpackages.php [+] add_news.php [+] add_banner.php [+] addaccomtypeavailability.php [+] addcustomers.php Vulnerable Module(s): [+] Title & Name 1.4 Multiple non persistent cross site scripting vulnerabilities are detected in iScripts Reserve Logic v1.2 Booking Content Management System. The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high required user inter action or local low privileged user account. The bugs are located in the locationdetails.php, bookings.php, addpackages.php, addaccomtypeavailability.php, add_news.php, add_banner.php & editfeedback.php files with the bound vulnerable parameters nid, id, nBId, mbSearch, postsearch, txtkey, page & did. Successful exploitation can result in account steal, client side phishing & client-side content request manipulation. Exploitation requires low user inter action or low privileged application user account. Vulnerable File(s): [+] locationdetails.php [+] bookings.php [+] addpackages.php [+] add_news.php [+] addaccomtypeavailability.php [+] add_banner.php [+] editfeedback.php Vulnerable Parameter(s): [+] nid [+] id [+] nBId [+] mbSearch, postsearch & txtkey [+] page [+] did Proof of Concept: ================= 1.1 The blind and standard SQL Injection vulnerabilities can be exploited by remote attacker with & without privileged user account. User inter action is not required for exploitation. For [PATH]nstration or reproduce ... http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[SQL-INJECTION]AND+substring(version(),1)=5 http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[SQL-INJECTION]Union+select+1,2,3,4,5...30--%20- 0&sort=x&txtFromDate=x&txtToDate=x http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&orderby=-1%27[SQL-INJECTION] &sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012 http://127.0.0.1:1337/reservelogic/[PATH]/admin/users_report.php?rghtMenu=rghtMenu3&orderby=[SQL-INJECTION]dDatejoin &sort=ASC&txtFromDate=05-17-2012&txtToDate=06-16-2012 Blind SQL injection - Pre Auth http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4+[BLIND SQL-INJECTION] http://127.0.0.1:1337/reservelogic/[PATH]/packagedetails.php?pid=4[BLIND SQL-INJECTION] +AND+substring(version(),1)=5 Blind SQL injection - Auth http://127.0.0.1:1337/reservelogic/[PATH]/admin/editenquiries.php?id=7[BLIND SQL-INJECTION] &postsearch=S&cmbSearch=&page=1&txtkey= http://127.0.0.1:1337/reservelogic/[PATH]/admin/addclientlocations.php?id=23[BLIND SQL-INJECTION] http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND SQL-INJECTION] http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php?id=65[BLIND SQL-INJECTION] +AND+1=2&postsearch=S&cmbSearch=&page=1&txtkey= http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5[BLIND SQL-INJECTION] http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php?id=5+AND+1=2[BLIND SQL-INJECTION] &postsearch=S&cmbSearch=&page=1&txtkey= http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php?id=72[BLIND SQL-INJECTION] http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&[BLIND SQL-INJECTION] &sort=ASC&txtFromDate=x&txtToDate=x http://127.0.0.1:1337/reservelogic/[PATH]/admin/booking_report.php?rghtMenu=rghtMenu3&AND+1=1[BLIND SQL-INJECTION] &sort=ASC&txtFromDate=x&txtToDate=x http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4[BLIND SQL-INJECTION] &postsearch=S&cmbSearch=&page=1&txtkey= http://127.0.0.1:1337/reservelogic/[PATH]/admin/addspecialoffer.php?id=4'[BLIND SQL-INJECTION] &postsearch=S&cmbSearch=&page=1&txtkey= 1.2 The arbitrary file upload vulnerability can be exploited by local priviliged user account without required user inter action. For demonstration or reproduce ... http://127.0.0.1:1337/reservelogic/[PATH]/admin/addlocationphotos.php Execution > http://127.0.0.1:1337/reservelogic/[PATH]/admin/galleryimages/ 1.3 The persistent input validation vulnerabilities can be exploited by remote attackers with low privileged user account & low user inter action. For demonstration or reproduce ... Note: To reproduce the issue inject your own script code to the title input fields (Title or Name) and watch the affected vulnerable output listing. http://127.0.0.1:1337/reservelogic/[PATH]/admin/addpackages.php http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_news.php http://127.0.0.1:1337/reservelogic/[PATH]/admin/add_banner.php http://127.0.0.1:1337/reservelogic/[PATH]/admin/addaccomtypeavailability.php http://127.0.0.1:1337/reservelogic/[PATH]/admin/addcustomers.php Review: Add Package - Title Title