S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
high·Product Based Web Vulnerabilities·Updated Oct 8, 2024

Taiwanese Travel Local File Inclusion Scanner

Targets the file inclusion parameter in Taiwanese Travel's itinerary module, allowing attackers to read arbitrary server files.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsurl
CostFree
2.8k
Times Used
continuous scan runs
5.9k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
Detail

Taiwanese Travel is a web application designed for travelers to plan trips, share experiences, and manage bookings across Taiwan. It is widely used by travel agencies, independent tourists, and local guides to access destination information, create itineraries, and engage with a community of travelers. The platform streamlines trip planning with features like route optimization, accommodation listings, and user reviews, making it essential for tourism in Taiwan. Its popularity and reliance on user-generated content require robust security to protect sensitive data and ensure service reliability.

Local File Inclusion (LFI) is a vulnerability that occurs when an application includes files based on user-supplied input without proper validation. In Taiwanese Travel, this arises from insecure handling of file paths in dynamic content loading, such as including templates or resources based on parameters. Attackers can manipulate these inputs to include arbitrary files from the server, leading to information disclosure or remote code execution if combined with file uploads.

The vulnerability specifically affects the 'lang' parameter in the 'index.php' endpoint, which is used to load language files. By injecting path traversal sequences like '../../etc/passwd', an attacker can read sensitive system files. The application fails to sanitize or restrict the file path, allowing inclusion of files outside the intended directory. This endpoint is commonly accessed during user session initialization, making it a prime target for exploitation.

If exploited, an attacker can read configuration files containing database credentials, application source code, or user data. This can lead to full server compromise, data breaches, and unauthorized access to administrative functions. The high CVSS score of 8.5 reflects the severe impact on confidentiality and integrity, potentially damaging user trust and causing regulatory penalties for data exposure.

Solution Advice
  • Implement strict input validation for the 'lang' parameter, allowing only predefined language codes.
  • Use a whitelist of allowed file paths and reject any input containing directory traversal sequences.
  • Disable PHP's allow_url_include and allow_url_fopen directives to prevent remote file inclusion.
  • Apply proper file permissions to restrict access to sensitive system files.
  • Use a secure file inclusion function like file_get_contents() with a base directory restriction.
  • Regularly update and patch the Taiwanese Travel application to fix known vulnerabilities.
  • Conduct security audits and penetration testing to identify and remediate LFI flaws.
  • Implement a Web Application Firewall (WAF) to block malicious file inclusion attempts.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.