OPAC KpwinSQL LFI/XSS Vulnerabilities

vendor:

KpwinSQL

by:

Yakir Wizman

7,5

CVSS

HIGH

LFI/XSS

CWE

Product Name: KpwinSQL

Affected Version From: All

Affected Version To: All

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache/2.2.11 (Win32), PHP/5.2.9-2

2016

OPAC KpwinSQL LFI/XSS Vulnerabilities

KpwinSQL suffers from an unauthenticated file inclusion vulnerability (LFI) when input passed thru the 'lang' parameter to the following scripts which are not properly verified: index.php, help.php, logpin.php, brow.php, indexs.php, search.php, hledani.php, hled_hesl.php before being used to include files. This can be exploited to include files from local resources with their absolute path and with directory traversal attacks. Moreover, KpwinSQL system suffers from Cross Site Scripting vulnerability when input passed thru the 'vyhl' parameter to 'index.php' script which does not perform input validation.

Mitigation:

Input validation should be performed to prevent LFI and XSS attacks.

Source

Exploit-DB raw data:

OPAC KpwinSQL LFI/XSS Vulnerabilities

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Product Website	: http://www.kpsys.cz/
Affected version: All
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 
Description: 
KpwinSQL suffers from an unauthenticated file inclusion vulnerability (LFI) when input passed thru the 'lang' parameter to the following scripts which are not properly verified:
	+ index.php
	+ help.php
	+ logpin.php
	+ brow.php
	+ indexs.php
	+ search.php
	+ hledani.php
	+ hled_hesl.php
before being used to include files. This can be exploited to include files from local resources with their absolute path and with directory traversal attacks.

Moreover, KpwinSQL system suffers from Cross Site Scripting vulnerability when input passed thru the 'vyhl' parameter to 'index.php' script which does not perform input validation.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Tested on: Apache/2.2.11 (Win32)
           PHP/5.2.9-2
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Vulnerabilities discovered by Yakir Wizman
                              https://www.linkedin.com/in/yakirwizman
Date: 06.07.2016
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Proof Of Concept:

Local File Inclusion example:
http://server/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00

Cross Site Scripting example:
http://server/index.php?vyhl='><script>alert('XSS')</script>&lang=cze