SQL Injection in YzmCMS up to 7.5

Executive Summary

This vulnerability is a SQL injection flaw found in YzmCMS version 7.5, specifically in the installation module via the siteurl parameter.

The issue arises because user input for the "Site URL" is only processed with the trim() function and then directly concatenated into an SQL UPDATE statement without proper sanitization or use of parameterized queries.

An attacker can exploit this by deleting the cache/install.lock file to re-enter the installation process, then inputting a crafted payload in the "Site Domain" field on the Site Configuration page.

This allows the attacker to inject malicious SQL commands, such as error-based techniques like updatexml, to extract sensitive database information including usernames, versions, and administrator credentials.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to serious impacts including data exfiltration, where sensitive information such as database contents and administrator credentials can be stolen.

Attackers may also achieve account takeover by obtaining administrative credentials.

Furthermore, it can lead to remote code execution (RCE) by modifying backend templates to inject PHP code, potentially allowing full control over the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the SQL injection in the installation module via the siteurl parameter during the installation process of YzmCMS v7.5.

To detect it, you can try to reproduce the issue by deleting the cache/install.lock file to re-enter the installation process, then navigate to the "Site Configuration" page and input a crafted SQL injection payload in the "Site Domain" field.

For example, you might use SQL injection payloads that leverage error-based techniques such as updatexml to extract database information.

Specific commands depend on your testing environment, but a common approach is to use curl or a web proxy tool to send HTTP POST requests with malicious siteurl parameters to the /application/install/index.php endpoint after resetting the installation state.

• Delete the cache/install.lock file to reset installation: `rm cache/install.lock`
• Send a crafted POST request with a SQL injection payload in the siteurl parameter, for example using curl:
• `curl -X POST -d "siteurl=1' OR updatexml(1,concat(0x7e,(SELECT database()),0x7e),1)#" http://target/application/install/index.php`

Observe the response for SQL error messages or extracted data indicating successful injection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing access to the installation module by ensuring the installation lock file (cache/install.lock) exists and cannot be deleted or bypassed.

Restrict access to the /application/install/index.php file via web server configuration or firewall rules to trusted administrators only.

Avoid exposing the installation process on production systems and ensure that the siteurl parameter is properly sanitized or disabled after installation.

Monitor logs for suspicious requests targeting the installation module and the siteurl parameter.

Since the vendor has not responded, consider applying custom patches or using web application firewalls (WAF) to block SQL injection payloads targeting this parameter.

Useful 0 Not Useful 0