← Advisories

AWBS v2.9.6 Multiple Remote Vulnerabilities

High
Advisory ID
ZSL-2016-5337
Release Date
05 July 2016
Vendor
Total Online Solutions, Inc. - http://www.awbs.com
Affected Version
2.9.6
CVE
N/A
Tested On
Apache, PHP/5.3.28, MySQL/5.5.50-cll
Summary

Whether starting new or looking to expand your existing web hosting and/or domain registration business, the AWBS fully automated solutions and unique features will allow you achieve your goal with minimum effort and cost.

Description

AWBS suffers from multiple SQL Injection vulnerabilities. Input passed via the 'cat' and 'so' GET parameters are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Multiple cross-site scripting vulnerabilities were also discovered. The issue is triggered when input passed via multiple parameters is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
Disclosure Timeline
08.06.2016Vulnerability discovered.
08.06.2016Contact with the vendor.
12.06.2016Vendor responds asking for details.
13.06.2016Vulnerability details sent to the vendor.
24.06.2016Follow up with the vendor on patch release date.
04.07.2016No response from the vendor.
05.07.2016Public security advisory released.
Credits
Vulnerability discovered by Bikramaditya Guha
References
Changelog
05.07.2016Initial release
06.07.2016Added reference [1], [2] and [3]
18.07.2016Added reference [4], [5] and [6]