CMS Web-Gooroo up to 1.140 authorization.inc.php wbg_login sql injection

Summaryinfo

A vulnerability marked as critical has been reported in CMS Web-Gooroo up to 1.140. The impacted element is an unknown function of the file /wbg/core/_includes/authorization.inc.php. This manipulation of the argument wbg_login causes sql injection. This vulnerability is registered as CVE-2017-18346. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in CMS Web-Gooroo up to 1.140 (Content Management System) and classified as critical. Affected by this vulnerability is an unknown code of the file /wbg/core/_includes/authorization.inc.php. The manipulation of the argument wbg_login with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to execute arbitrary SQL commands via the wbg_login parameter.

The weakness was published 06/01/2017 as EDB-ID 42577 as not defined exploit (Exploit-DB). It is possible to read the advisory at exploit-db.com. This vulnerability is known as CVE-2017-18346 since 08/26/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK. Responsible for the vulnerability is the following code:

$SQL_query = 'SELECT * FROM wbg_users WHERE (login=\'' . $_POST['wbg_login'] . '\') AND (password=\'' . md5(md5($_POST['wbg_password'])) . '\')';
$USER = mysql_fetch_assoc(mysql_query($SQL_query));

After immediately, there has been an exploit disclosed. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:wbg/core/_includes/authorization.inc.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.141 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (42577). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• CMS Web-Gooroo

Version

• 1.140

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #34: CMS Web-Gooroo <= 1.141 SQL Injection (by Kaimi)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion