Sophos Cyberoam CR500iNG-XP up to 10.6.2 MR-1 login.xml Username sql injection

Summaryinfo

A vulnerability was found in Sophos Cyberoam CR500iNG-XP up to 10.6.2 MR-1. It has been classified as critical. The impacted element is an unknown function of the file login.xml. The manipulation of the argument Username with the input cyberuser' AND 'x'='x leads to sql injection. This vulnerability is traded as CVE-2015-6811. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to apply restrictive firewalling.

Detailsinfo

A vulnerability was found in Sophos Cyberoam CR500iNG-XP up to 10.6.2 MR-1. It has been rated as critical. This issue affects an unknown code block of the file login.xml. The manipulation of the argument username with the input value cyberuser' AND 'x'='x leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.

The weakness was shared 08/31/2015 by Dharmendra Kumar Singh as File 133378 / EDB-ID 38034 as confirmed advisory (Packetstorm). It is possible to read the advisory at packetstormsecurity.com. The vendor was not involved in the public release. The identification of this vulnerability is CVE-2015-6811 since 09/04/2015. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK. The advisory points out:

The username field is vulnerable to the following types of SQL Injections a) Boolean-based blind sql injection b) Stacked queries

A public exploit has been developed by Dharmendra Kumar Singh in Curl and been published immediately after the advisory. The exploit is available at packetstormsecurity.com. It is declared as proof-of-concept. By approaching the search of inurl:login.xml it is possible to find vulnerable targets with Google Hacking. The code used by the exploit is:

sqlmap.py -u "http://example.com:8090/login.xml" --data "mode=191&username=cyberuser&password=cyberpass&a=1439886198757&producttype=0"

The data send to the server while logging in through the captive portal is like "mode=191&username=cyberuser&password=cyberpass&a=1439886198757&producttype=0" The query generated in backend server must be something like this SELECT password FROM table_name WHERE username = 'cyberuser'

Addressing this vulnerability is possible by firewalling .

The vulnerability is also documented in the vulnerability database at Exploit-DB (38034). cert.civis.net is providing further details. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Sophos

Name

• Cyberoam CR500iNG-XP

Version

• 10.6.2 MR-1

License

• commercial

Website

• Vendor: https://www.sophos.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion