lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 12 Feb 2020 20:05:38 +0100
From: Egidio Romano <research@...mainsecurity.com>
To: fulldisclosure@...lists.org
Subject: [FD] [KIS-2020-05] SuiteCRM <= 7.11.10 Multiple SQL Injection
 Vulnerabilities

----------------------------------------------------------
SuiteCRM <= 7.11.10 Multiple SQL Injection Vulnerabilities
----------------------------------------------------------


[-] Software Link:

https://suitecrm.com/


[-] Affected Versions:

Version 7.11.10 and prior versions.


[-] Vulnerabilities Description:

1) The vulnerability is located within the SOAP API, specifically into 
the set_entries() SOAP
function. User input passed through the "name_value_lists" parameter 
(specifically the "first_name"
and "last_name" elements) isn’t properly sanitized before being used to 
construct a SQL query from
within the check_for_duplicate_contacts() function. This can be 
exploited by malicious users to e.g.
read sensitive data from the database through in-bound SQL injection 
attacks.

2) The vulnerability is located within the EmailUIAjax interface. User 
input passed through the
"bean_module" and "bean_id" parameters when handling the "addContact" 
action isn’t properly sanitized
before being used to construct a SQL query. This can be exploited by 
malicious users to read sensitive
data from the database through boolean-based SQL injection attacks.

3) The vulnerability is located within the EmailUIAjax interface. User 
input passed through the
"contactData" parameter when handling the "addContactsMultiple" action 
isn’t properly sanitized
before being used to construct a SQL query. This can be exploited by 
malicious users to read
sensitive data from the database through boolean-based SQL injection 
attacks.

4) The vulnerability is located within the EmailUIAjax interface. User 
input passed through the "ids"
parameter when handling the "removeContact" action isn’t properly 
sanitized before being used to
construct a SQL query. This can be exploited by malicious users to read 
sensitive data from the database
through time-based SQL injection attacks.

5) The vulnerability is located within the MailMerge module. User input 
passed through the "rel_module"
parameter when handling the "search" action isn’t properly sanitized 
before being used to construct a
SQL query. This can be exploited by malicious users to read sensitive 
data from the database through
time-based SQL injection attacks.


[-] Solution:

Upgrade to version 7.11.11 or later.


[-] Disclosure Timeline:

[19/09/2019] - Vendor notified
[20/09/2019] - Vendor acknowledgement
[12/11/2019] - Vendor contacted again asking for updates, no response
[20/01/2020] - Vendor notified about public disclosure intention, no 
response
[07/02/2020] - CVE number assigned
[10/02/2020] - Version 7.11.11 released
[12/02/2020] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2020-8804 to these vulnerabilities.


[-] Credits:

Vulnerabilities discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2020-05


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists