Executive Summary

This vulnerability is a flaw in the phili67 Ecclesia CRM software, specifically in the ValidateInput function of the Query Viewer Component located in the /v2/query/view/ file. The flaw allows an attacker to manipulate the 'custom' argument, which leads to a SQL injection vulnerability. This means that an attacker can remotely inject malicious SQL code into the system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows remote attackers to perform SQL injection attacks, which can lead to unauthorized access to the database. This can result in data leakage, data modification, or disruption of the affected system's operations. Since the exploit has been published and the vendor did not respond, the risk of exploitation is higher.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows for SQL injection leading to potential full database exfiltration, including sensitive personal data. This poses a high confidentiality risk and could result in unauthorized access to personal and sensitive information.

Such unauthorized access and potential data breaches can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive data against unauthorized access and disclosure.

Therefore, exploitation of this vulnerability could result in violations of these standards due to compromised confidentiality and integrity of protected data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the vulnerable endpoint /v2/query/view/{id} for SQL injection by submitting crafted POST requests with malicious parameters.

A common detection method is to attempt a UNION-based SQL injection using the 'custom' parameter in a POST request to see if database information can be extracted.

For example, you can use the following curl command to test for the vulnerability:

• curl -X POST -d "custom=per_ID AND 1=0 UNION SELECT 1, CONCAT(usr_UserName, ':', usr_Password), 3 FROM user_usr -- -" https://target-ecclesiacrm/v2/query/view/200

If the response contains concatenated usernames and password hashes, it indicates the presence of the SQL injection vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Replace manual string substitution in the code with parameterized queries (prepared statements) using PDO or MySQLi to prevent SQL injection.
• Enhance input validation in the ValidateInput() function by sanitizing inputs using mysqli_real_escape_string() or type casting as a temporary measure.
• Remove the code that outputs the full SQL query in HTML comments to prevent information leakage.

These steps help prevent exploitation until a full patch or update can be applied.

Useful 0 Not Useful 0