{"id":22060,"date":"2024-01-19T13:38:29","date_gmt":"2024-01-19T12:38:29","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=22060"},"modified":"2024-02-07T12:43:34","modified_gmt":"2024-02-07T11:43:34","slug":"usd-2023-0047","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2023-0047\/","title":{"rendered":"usd-2023-0047"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.23.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n<h1>usd-2023-0047 | Gambio 4.9.2.0 - SQL-Injection<\/h1>\n<h1><\/h1>\n<p><strong>Product<\/strong>: Gambio<br \/><strong>Affected Version<\/strong>: 4.9.2.0<br \/><strong>Vulnerability Type<\/strong>: CWE-89 - SQL Injection<br \/><strong>Security Risk<\/strong>: Critical<br \/><strong>Vendor URL<\/strong>: <a href=\"https:\/\/www.gambio.de\" target=\"_blank\" rel=\"noopener\">https:\/\/www.gambio.de\/<\/a><br \/><strong>Vendor Status<\/strong>: Fixed<br \/><strong>CVE Number<\/strong>: CVE-2024-23763<\/p>\n<h3>Description<\/h3>\n<p>Gambio is software designed for running online shops.<br \/>It provides various features and tools to help businesses manage their inventory, process orders, and handle customer interactions.<\/p>\n<p>According to their homepage, the software is used by more than 25.000 shops.<\/p>\n<p>The <strong>\/shop.php<\/strong> endpoint is vulnerable to a SQL Injection in the <strong>modifiers[attribute][]<\/strong> parameter.<\/p>\n<p><strong>Note:<\/strong> Upon discovery, our team immediately initiated the responsible disclosure process by contacting the vendor behind Gambio.<br \/>Unfortunately, despite multiple attempts, our attempts to engage the vendor in resolving this issue have been met with silence.<br \/>The vulnerability is still unfixed.<\/p>\n<h3>Proof of Concept<\/h3>\n<p><!-- describe how the vulnerability can be exploited -->The SQL Injection is error-based and can be triggered using a GET request to the following endpoint:<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span>\/shop.php?do=CheckStatus\/Attributes&amp;galleryHash=dddd&amp;modifiers%5Battribute%5D%5B4%5D=9'&amp;products_id=2&amp;products_qty=1&amp;target=cart&amp;isProductInfo=1&amp;page_token=<\/pre>\n<\/div>\n<h3>Fix<\/h3>\n<p>Use prepared statements.<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.gambio.de\" target=\"_blank\" rel=\"noopener\">https:\/\/www.gambio.de<\/a><\/li>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/SQL_Injection\" target=\"_blank\" rel=\"noopener\">https:\/\/owasp.org\/www-community\/attacks\/SQL_Injection<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2023-12-08<\/strong>: First contact request via email.<\/li>\n<li><strong>2023-12-21<\/strong>: Second contact request via email.<\/li>\n<li><strong>2024-01-17<\/strong>: This advisory is published.<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was identified by Christian Poeschl and Lukas Schraven of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2023-0047 | Gambio 4.9.2.0 - SQL-Injection Product: GambioAffected Version: 4.9.2.0Vulnerability Type: CWE-89 - SQL InjectionSecurity Risk: CriticalVendor URL: https:\/\/www.gambio.de\/Vendor Status: FixedCVE Number: CVE-2024-23763 Description Gambio is software designed for running online shops.It provides various features and tools to help businesses manage their inventory, process orders, and handle customer interactions. According to their homepage, the software [&hellip;]<\/p>\n","protected":false},"author":115,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-22060","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/115"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=22060"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22060\/revisions"}],"predecessor-version":[{"id":22359,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22060\/revisions\/22359"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=22060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}