Oliver 5 Library Server Local File Inclusion Scanner

Oliver 5 Library Server is a software solution commonly used by libraries to manage book inventories, user information, and other library services. It is popular among various educational institutions, including schools and universities, for its comprehensive management capabilities. The software allows librarians to easily track, catalog, and manage library resources efficiently. Libraries utilize this server for handling daily operations such as check-ins, check-outs, and inventory management. The Oliver 5 Library Server is designed to be user-friendly and offers customizable settings to fit the individuated needs of various libraries. It is integral in assisting libraries in maintaining organized and systematic management of their resources.

Local File Inclusion (LFI) is a type of security vulnerability typically found in web applications. It allows an attacker to include files from a server through the web browser. This vulnerability is often used to view files on a server by manipulating the 'include' functionality, potentially gaining access to sensitive information. If exploited, LFI can expose configuration files, credentials, and other sensitive data stored on the server. It relies on injecting a file path into the application's file inclusion mechanism, tricking it into retrieving the unauthorized file. This class of vulnerability is critical as it may lead to further exploitation, such as remote code execution.

The LFI vulnerability in Oliver 5 Library Server occurs via the "FileServlet" function within its codebase. This endpoint appears to lack proper parameter validation, allowing attackers to manipulate the 'fileName' parameter. By altering this parameter, an attacker could access unauthorized files on the server, such as the "win.ini" file on Windows systems. This vulnerability is particularly troublesome, as it exposes internal files that may contain sensitive configurations or credentials. The endpoint is exploited through an HTTP GET request to read files beyond those intended to be accessed by users. Proper input validation and sanitization measures are not implemented, allowing this vulnerability to persist.

If successfully exploited, this vulnerability can lead to unauthorized access to sensitive files stored on the server, which may include configuration files, credentials, or other private data. Attackers could gain insights into the server setup, credentials, and other restricted information that could facilitate further attacks or breaches. This exposure can compromise the confidentiality, integrity, and security of the library server and its users. Moreover, this could lead to unauthorized data disclosure or significant operational disruption of the library's services. In more severe cases, an attacker may leverage the information obtained to execute remote code or escalate privileges on the server.

REFERENCES

• https://www.exploit-db.com/exploits/50599
• https://www.softlinkint.com/product/oliver/