SQLiteManager 1.2.0/1.2.4 main.php?dbsel=-1%20or%2072%20=%2072 sql injection

Summaryinfo

A vulnerability marked as critical has been reported in SQLiteManager 1.2.0/1.2.4. This vulnerability affects unknown code of the file /sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2072. The manipulation leads to sql injection. This vulnerability is traded as CVE-2019-9083. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is advised to substitute the affected component with an alternative.

Detailsinfo

A vulnerability was found in SQLiteManager 1.2.0/1.2.4. It has been rated as critical. This issue affects an unknown code of the file /sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2072. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.

The bug was discovered 02/17/2019. The weakness was shared 02/25/2019 by Rafael Pedrero as [CVE-2019-9083] Blind SQL injection in SQLiteManager 1.2.0 (and 1.2.4) as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2019-9083 since 02/24/2019. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1505 for this issue.

A public exploit has been developed by Rafael Pedrero and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

POST /sqlite/main.php?dbsel=-1%20or%2032%20%3d%2030 HTTP/1.1
Content-Length: 191
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=s5uogfet0s4nhr81ihgmg5l4v3;
SQLiteManager_currentTheme=default; SQLiteManager_currentLangue=8;
SQLiteManager_fullText=0; SQLiteManager_HTMLon=0
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64;
Trident/5.0)

action=save&ColumnList=1&ConditionList=1&trigger=&TriggerAction=FOR%20EACH%20ROW&TriggerCondition=WHEN&TriggerEvent=DELETE&TriggerMoment=BEFORE&TriggerName=kqluvanc&TriggerOn=t1&TriggerStep=1

The problem might be mitigated by replacing the product with as an alternative.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47310). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• SQLiteManager

Version

• 1.2.0
• 1.2.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion