SQL Injection in webSPELL

[High-Tech Bridge Security Research <advisory () htbridge ch>]

Advisory ID: HTB23291
Product: webSPELL
Vendor: webSPELL.org
Vulnerable Version(s): 4.2.4 and probably prior
Tested Version: 4.2.4
Advisory Publication:  January 22, 2016  [without technical details]
Vendor Notification: January 22, 2016 
Vendor Patch: February 12, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: Medium 
CVSSv3 Base Score: 6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a popular CMS webSPELL developed for the needs 
of esport related communities. The vulnerability allows a remote authenticated attacker with cashbox access privileges 
to execute arbitrary SQL commands in application’s database and completely compromise the vulnerable website. This 
vulnerability can be also exploited by non-authenticated and unprivileged attacker via the CSRF vector, to which the 
system is also prone. 

The vulnerability exists due to insufficient filtration of user-supplied data passed via "payid" HTTP POST parameter to 
"/cash_box.php" script. A remote authenticated attacker, with cashbox access privileges, can alter the present SQL 
query and execute arbitrary SQL commands in application’s database. 

A simple exploit below uses a time-based SQL injection technique to determine current version of MySQL server. The page 
will be loaded with some delay, if the current MySQL server version is 5.x:


<form action="http://[host]/cash_box.php"; method="post" name="main">
<input type="hidden" name="pay" value="1">
<input type="hidden" name="payid[' PROCEDURE analyse((select extractvalue(rand(), concat(0x3a, (IF(MID(version(), 1, 1) 
LIKE 5, BENCHMARK(5000000, SHA1(1)), 1))))), 1) -- 2]" value="1">
<input value="submit" id="btn" type="submit" />
</form>


This vulnerability can be also exploited via CSRF vector, as the "/cash_box.php" script does not validate origin of 
HTTP request before processing user-supplied data in SQL query.


-----------------------------------------------------------------------------------------------

Solution:

Update to webSPELL 4.2.5

More Information:
https://github.com/webSPELL/webSPELL/issues/309

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23291 - https://www.htbridge.com/advisory/HTB23291 - SQL Injection in webSPELL
[2] webSPELL - https://www.webspell.org/ - webSPELL is a free content management system under GNU GPL for creating 
websites easily
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE 
is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and 
continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST 
compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details 
of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.