Kasseler-cms 2 admin.php groups[] sql injection

Summaryinfo

A vulnerability classified as problematic has been found in Kasseler-cms 2. The affected element is an unknown function of the file admin.php. The manipulation of the argument groups[] leads to sql injection. This vulnerability is documented as CVE-2013-3727. The attack can be initiated remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Kasseler-cms 2 (Content Management System). This issue affects some unknown processing of the file admin.php. The manipulation of the argument groups[] with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

The weakness was released 03/13/2014 (Website). It is possible to read the advisory at htbridge.com. The identification of this vulnerability is CVE-2013-3727 since 05/30/2013. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:admin.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (85407), Exploit-DB (26623) and OSVDB (94779†). Entries connected to this vulnerability are available at VDB-66613 and VDB-66612. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Kasseler-cms

Version

• 2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion