SQL Injection in webSPELL

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxx>]

Advisory ID: HTB23291
Product: webSPELL
Vendor: webSPELL.org
Vulnerable Version(s): 4.2.4 and probably prior
Tested Version: 4.2.4
Advisory Publication:  January 22, 2016  [without technical details]
Vendor Notification: January 22, 2016 
Vendor Patch: February 12, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: Medium 
CVSSv3 Base Score: 6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a 
popular CMS webSPELL developed for the needs of esport related communities. The 
vulnerability allows a remote authenticated attacker with cashbox access 
privileges to execute arbitrary SQL commands in application’s database and 
completely compromise the vulnerable website. This vulnerability can be also 
exploited by non-authenticated and unprivileged attacker via the CSRF vector, 
to which the system is also prone. 

The vulnerability exists due to insufficient filtration of user-supplied data 
passed via "payid" HTTP POST parameter to "/cash_box.php" script. A remote 
authenticated attacker, with cashbox access privileges, can alter the present 
SQL query and execute arbitrary SQL commands in application’s database. 

A simple exploit below uses a time-based SQL injection technique to determine 
current version of MySQL server. The page will be loaded with some delay, if 
the current MySQL server version is 5.x:


<form action="http://[host]/cash_box.php"; method="post" name="main">
<input type="hidden" name="pay" value="1">
<input type="hidden" name="payid[' PROCEDURE analyse((select 
extractvalue(rand(), concat(0x3a, (IF(MID(version(), 1, 1) LIKE 5, 
BENCHMARK(5000000, SHA1(1)), 1))))), 1) -- 2]" value="1">
<input value="submit" id="btn" type="submit" />
</form>


This vulnerability can be also exploited via CSRF vector, as the 
"/cash_box.php" script does not validate origin of HTTP request before 
processing user-supplied data in SQL query.


-----------------------------------------------------------------------------------------------

Solution:

Update to webSPELL 4.2.5

More Information:
https://github.com/webSPELL/webSPELL/issues/309

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23291 - 
https://www.htbridge.com/advisory/HTB23291 - SQL Injection in webSPELL
[2] webSPELL - https://www.webspell.org/ - webSPELL is a free content 
management system under GNU GPL for creating websites easily
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by 
High-Tech Bridge for on-demand and continuous web application security, 
vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL 
implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.