Executive Summary

CVE-2019-25643 affects eNdonesia Portal version 8.7 and earlier, involving multiple SQL injection vulnerabilities in the banners.php file. Specifically, unauthenticated attackers can exploit the bid parameter by sending crafted GET requests containing malicious SQL payloads.

This allows attackers to execute arbitrary SQL queries and extract sensitive information from the database, including data from the INFORMATION_SCHEMA tables.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and has a high severity rating with a CVSS v4 score of 8.8.

Attackers do not need any privileges or user interaction to exploit this vulnerability remotely.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL queries on the affected system's database."}, {'type': 'paragraph', 'content': 'As a result, attackers can extract sensitive and critical database information, potentially including user data, configuration details, and other confidential information stored in the database.'}, {'type': 'paragraph', 'content': 'Because the attack requires no privileges or user interaction, it poses a significant security risk, potentially leading to data breaches and unauthorized data disclosure.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending crafted GET requests to the banners.php file with malicious SQL payloads in the bid parameter and observing the responses for signs of SQL injection.'}, {'type': 'paragraph', 'content': 'Example detection commands include sending GET requests with payloads that exploit MySQL error-based SQL injection techniques using INFORMATION_SCHEMA tables and RAND() function to trigger database errors or extract data.'}, {'type': 'list_item', 'content': 'curl "http://<target>/endonesia87/banners.php?op=click&bid=-1 or 1=1 and (SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)"'}, {'type': 'list_item', 'content': 'curl "http://<target>/endonesia87/admin.php?op=BannerDelete&bid=-1 or 1=1 and (SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)&ok=3"'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable scripts, such as banners.php and admin.php, by implementing firewall rules or access controls to limit exposure.

Additionally, input validation and sanitization should be applied to the bid parameter and other user inputs to prevent SQL injection attacks.

If possible, update or patch the eNdonesia Portal software to a version where these vulnerabilities are fixed.

Monitoring and logging suspicious requests targeting the bid parameter can help detect exploitation attempts.

Useful 0 Not Useful 0