elttam/ko7demoA docker-contained koseven hello world to play with SQL injection CVE-2019-8979 affecting versions < 3.3.10
A docker-contained https://github.com/koseven/koseven[koseven] hello world to play with CVE-2019-8979, a SQL injection vulnerability affecting versions < 3.3.10. This hello world actually comes from the https://koseven.dev/documentation/orm/examples/simple[documentation], I just added the Docker parts and the PoC exploit.
= CVE-2019-8979 This SQL injection issue was originally https://github.com/koseven/koseven/issues/323[reported] by a third party and fixed on 27 Feb 2019 in master but the devs forgot to publish a new release containing the fix. As a result the latest stable release at the time, https://github.com/koseven/koseven/releases/tag/3.3.9[koseven-3.3.9] published on 20 Nov 2018, remained vulnerable until https://github.com/koseven/koseven/releases/tag/3.3.10[koseven-3.3.10] was released on 12 Oct 2020, after https://elttam.com[elttam] noticed and privately disclosed the oversight to the core developers on 10 Oct 2020.
= Limitations
Although some information can be obtained from MySQL such as current_user(), database() or table and column names from information_schema, it may not be possible to retrieve data from other tables due to strtoupper() being https://github.com/koseven/koseven/blob/3.3.9/modules/database/classes/Kohana/Database/Query/Builder.php#L236[called] on the order by direction input.
This is because database and table names are case sensitive when MySQL is running on an operating sytem where the data directory resides on a case sensitive filesystem. As a result this SQLi may only be fully exploitable if:
lower_case_table_names sysvar is > 0See https://dev.mysql.com/doc/refman/8.0/en/identifier-case-sensitivity.html[Identifier Case Sensitivity] for more info.
= Demo
[#img-demo] [link=https://asciinema.org/a/uQYxQn4vbB6XRFjf8pdIGbmAr] image::https://asciinema.org/a/uQYxQn4vbB6XRFjf8pdIGbmAr.png[Demo,200,200]