Headline

CVE-2019-5109: TALOS-2019-0902 || Cisco Talos Intelligence Group

Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.

5 years ago

CVE

Open in Source

#sql #vulnerability #web #windows #cisco #intel #php #auth #firefox

Summary

Tested Versions

Forma LMS 2.2.1

Product URLs

https://www.formalms.org/

CVSSv3 Score

7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)

Details

An SQL injection vulnerability exists in Forma LMS 2.2.1. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.

The /appCore/ajax.adm_server.php URL and parameter dir have been confirmed to suffer from SQL injections and could be exploited by authenticated attackers:

POST /appCore/ajax.adm_server.php?r=alms/enrollrules/get HTTP/1.1
Host: [IP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://[IP]/appCore/index.php?r=alms/enrollrules/show
X-Requested-With: XMLHttpRequest
X-Signature: [SIG]
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 76
DNT: 1
Connection: close
Cookie: docebo_session=[SESSIONID]; 11836.my_course.type=elearning; 11836.my_course.category=0; 11836.my_course.year=0; catalog[0].type_course=classroom

sort=title&dir=asc[SQLINJECTION]&startIndex=0&results=1

Timeline

2019-09-19 - Vendor Disclosure
2019-11-29 - Vendor patched
2019-12-02 - Public Release

Discovered by Yuri Kramarz of Security Advisory EMEAR.