Stay in Touch

Weekly newsletter on AI, Application Security & Cybercrime


Your data will stay confidential Private and Confidential

SQL Injection in webSPELL

Advisory ID:HTB23291
Product:webSPELL
Vendor:webSPELL.org
Vulnerable Versions:4.2.4 and probably prior
Tested Version:4.2.4
Advisory Publication:January 22, 2016 [without technical details]
Vendor Notification:January 22, 2016
Vendor Fix:February 12, 2016
Public Disclosure:February 17, 2016
Vulnerability Type:SQL Injection [CWE-89]
CVE Reference:Pending
Risk Level:Medium
CVSSv3 Base Score:6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L]
CVSSv3 Calculator
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a popular CMS webSPELL developed for the needs of esport related communities. The vulnerability allows a remote authenticated attacker with cashbox access privileges to execute arbitrary SQL commands in application’s database and completely compromise the vulnerable website. This vulnerability can be also exploited by non-authenticated and unprivileged attacker via the CSRF vector, to which the system is also prone.

The vulnerability exists due to insufficient filtration of user-supplied data passed via "payid" HTTP POST parameter to "/cash_box.php" script. A remote authenticated attacker, with cashbox access privileges, can alter the present SQL query and execute arbitrary SQL commands in application’s database.

A simple exploit below uses a time-based SQL injection technique to determine current version of MySQL server. The page will be loaded with some delay, if the current MySQL server version is 5.x:

<form action="http://[host]/cash_box.php" method="post" name="main">
<input type="hidden" name="pay" value="1">
<input type="hidden" name="payid[' PROCEDURE analyse((select extractvalue(rand(), concat(0x3a, (IF(MID(version(), 1, 1) LIKE 5, BENCHMARK(5000000, SHA1(1)), 1))))), 1) -- 2]" value="1">
<input value="submit" id="btn" type="submit" />
</form>


This vulnerability can be also exploited via CSRF vector, as the "/cash_box.php" script does not validate origin of HTTP request before processing user-supplied data in SQL query.

How to Detect SQL Injection Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Solution:
Update to webSPELL 4.2.5

More Information:
https://github.com/webSPELL/webSPELL/issues/309


References:
[1] High-Tech Bridge Advisory HTB23291 - https://www.immuniweb.com/advisory/HTB23291 - SQL Injection in webSPELL
[2] webSPELL - https://www.webspell.org/ - webSPELL is a free content management system under GNU GPL for creating websites easily
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing.
[5] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Quick Start
Products
Free Trial
Newsletter