Executive Summary

This vulnerability is a SQL Injection issue found in the likeadmin_php product up to version 1.9.6. It exists in the function queryResult within the file server\app\adminapi\lists\tools\DataTableLists.php, specifically in the dataTable Admin API component.

The vulnerability occurs because user-supplied parameters (such as 'name' and 'comment') are concatenated directly into an SQL query without proper sanitization or parameterization. This unsafe dynamic SQL construction allows an attacker with administrator privileges to inject malicious SQL code.

The attack can be performed remotely and has been publicly disclosed. It can be exploited to perform time-based blind SQL Injection attacks, which can manipulate the database and extract sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data, modification of data, and disruption of service availability.

• Attackers with administrator privileges can exploit the SQL Injection to read, modify, or delete database contents.
• The integrity and confidentiality of the data managed by the likeadmin_php system can be compromised.
• Service availability may be affected due to potential disruptions caused by malicious SQL commands.

Overall, the vulnerability poses a high risk to the security and reliability of the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the vulnerable endpoint /adminapi/tools.generator/dataTable for SQL Injection using administrator privileges.

One method is to obtain an administrator token by sending a POST request to /adminapi/login/account with valid credentials.

Then, send crafted GET requests to /adminapi/tools.generator/dataTable with malicious 'name' parameter values to test for time-based blind SQL Injection, for example by injecting payloads that cause deliberate delays such as SLEEP(5).

An automated way to verify the vulnerability is to use sqlmap with the following command:

• python sqlmap.py -u "http://192.168.171.130:20221/adminapi/tools.generator/dataTable?name=1" --headers="Token: <admin_token>" --level 3 --dbs --batch

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to modify the vulnerable function queryResult to use parameterized queries instead of concatenating user inputs directly into SQL statements.

This involves changing the SQL construction to bind user inputs safely, for example:

• $sql = 'SHOW TABLE STATUS WHERE 1=1';
• $bindings = [];
• if (!empty($this->params['name'])) {
• $sql .= " AND name LIKE ?";
• $bindings[] = '%' . $this->params['name'] . '%';
• }
• if (!empty($this->params['comment'])) {
• $sql .= " AND comment LIKE ?";
• $bindings[] = '%' . $this->params['comment'] . '%';
• }
• return Db::query($sql, $bindings);

This change prevents SQL Injection by safely binding user inputs.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a SQL Injection in the likeadmin_php system that allows attackers with administrator privileges to access, modify, or disrupt data remotely. Such unauthorized access and manipulation of data can lead to breaches of confidentiality, integrity, and availability of sensitive information.

While the provided context does not explicitly mention compliance with standards like GDPR or HIPAA, SQL Injection vulnerabilities generally pose significant risks to compliance because they can result in unauthorized data exposure or alteration, which violates data protection and privacy requirements mandated by these regulations.

Therefore, this vulnerability could negatively impact compliance with common standards and regulations by exposing sensitive personal or protected health information to unauthorized parties, potentially leading to legal and regulatory consequences.

Useful 0 Not Useful 0