Executive Summary

No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint.

This vulnerability allows authenticated attackers to manipulate database queries by submitting POST requests with malicious SQL code in the order_by[0] parameter.

As a result, attackers can extract sensitive information from the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive database information.

Since attackers can manipulate database queries, they may extract confidential data, potentially leading to data breaches.

The CVSS v3.1 score of 7.1 indicates a high severity impact on confidentiality with limited impact on integrity and no impact on availability.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in No-CMS 1.0 allows authenticated attackers to extract sensitive database information by manipulating SQL queries. This exposure of sensitive data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access.

Because the vulnerability impacts confidentiality of data, organizations using affected versions of No-CMS may face risks related to data breaches, potentially resulting in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for POST requests to the endpoint /nocms/main/manage_privilege/index/export that include suspicious or malicious SQL code in the order_by[0] parameter.

A practical approach is to capture and analyze HTTP POST traffic targeting this endpoint and look for SQL injection patterns in the order_by parameter.

For example, using curl to test the endpoint with a crafted payload might help identify if the system is vulnerable:

• curl -X POST -d 'order_by[0]=1 UNION SELECT user(), database(), version()-- ' http://target/nocms/main/manage_privilege/index/export

Additionally, network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on POST requests containing SQL keywords or suspicious payloads in the order_by parameter.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint to only trusted authenticated users and monitoring for suspicious activity targeting the order_by parameter.

Applying input validation and sanitization on the order_by parameter to prevent SQL injection is critical.

If available, update No-CMS to a patched version that addresses this vulnerability.

As a temporary measure, consider disabling or restricting the manage_privilege export functionality if it is not essential.

Useful 0 Not Useful 0