Listen to this Post
The vulnerability exists in the `retrieve()` method within src/API/Manager.php. User-supplied input from the `display` GET parameter is processed without adequate sanitization. The code first removes the surrounding square brackets `[]` from the input string. It then splits the resulting string using commas, creating an array. Each element of this array is passed directly into the `selectRaw()` function of the Laravel query builder. Since the `selectRaw()` method is designed to accept and execute raw SQL expressions, any malicious SQL code provided within the `display` parameter is executed directly on the database. This flaw allows an attacker to inject arbitrary SQL commands, bypassing any application-level security controls.
Platform: OpenSTAManager
Version: All versions
Vulnerability: SQL Injection
Severity: Critical
date: 2024-10-14
Prediction: Patch 2024-10-28
What Undercode Say:
curl "http://localhost/openstamanager/api?token=abc123&resource=anagrafiche&display=[1,SLEEP(5)]"
$select = !empty($request['display']) ? explode(',', substr((string) $request['display'], 1, -1)) : null;
foreach ($select as $s) {
$query->selectRaw($s);
}
How Exploit:
Craft malicious `display` parameter.
Use authenticated API request.
Execute arbitrary SQL commands.
Protection from this CVE
Input validation.
Use parameterized queries.
Sanitize user input.
Impact:
Full database compromise.
Data exfiltration and modification.
Complete system access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
