PMB Local File Inclusion Scanner

PMB is an open-source integrated library management system used primarily by public libraries, schools, and resource centers worldwide for managing and cataloging collections, borrowing activities, and other library services. Its widespread usage is attributed to its comprehensive feature set, including catalog management, borrower administration, acquisition, and serial management. Public and academic libraries rely on PMB's robust database and user-friendly interface for day-to-day operations and enhancing user experiences. It's vital for libraries that need to efficiently organize vast datasets and ensure seamless access to digital and physical media. PMB provides a centralized platform for cataloging a diverse range of resources, from books to multimedia files. Regular updates and community support help ensure that PMB adapts to changing technological and user demands.

Local File Inclusion (LFI) is a vulnerability affecting PMB 5.6, where the application can be tricked into including local files, often leading to sensitive information disclosure. LFI occurs due to improper sanitization of user inputs, particularly when referencing file paths within the application's domain. In the case of PMB, the vulnerability is tied to the 'chemin' parameter used in file retrieval scripts. This can potentially allow unauthorized users to access and read restricted system files. Exploiting LFI weaknesses may give attackers insights into the server's configuration and potentially aid in further compromising the system. Thus, identifying and mitigating LFI vulnerabilities is crucial for maintaining the security integrity of web applications like PMB.

The vulnerability in PMB 5.6 arises through the improper handling of user input in the 'chemin' parameter used in file requests, specifically in the endpoint 'opac_css/getgif.php'. Because this parameter input is not properly sanitized, it lends itself to being manipulated, thus allowing an attacker to perform directory traversal attacks. This technique involves altering the file path to navigate through the server's directory structure and access files that should be restricted. Successful exploitation would involve accessing sensitive files, which could be leveraged for further attacks. The 'opac_css/getgif.php' endpoint, according to the scan pattern, specifically confirms LFI by validating responses that include standard system entries like '/etc/passwd' on Unix-based systems.

Exploiting the Local File Inclusion vulnerability can result in significant consequences, including unauthorized access to sensitive files and potentially critical system information disclosure. If such an LFI is used by malicious actors, it may lead to further infiltration, such as privilege escalation or moving laterally across network services. The attacker could also gain insights into configuration files, source code, or system logs which can expose other vulnerabilities. Beyond data breaches, the misuse of accessible scripts can lead to service disruption or data manipulation, severely impacting the integrity and availability of library services reliant on PMB.

REFERENCES

• https://packetstormsecurity.com/files/160072/PMB-5.6-Local-File-Disclosure-Directory-Traversal.html