full-disclosure - [FD] [KIS-2020-05] SuiteCRM <= 7.11.10 Multiple SQL Injection Vulnerabilities

Open Source and information security mailing list archives

Message-ID: <012bcf89d16d4e68675ff0e8942d3d6f@karmainsecurity.com>
Date: Wed, 12 Feb 2020 20:05:38 +0100
From: Egidio Romano <research@...mainsecurity.com>
To: fulldisclosure@...lists.org
Subject: [FD] [KIS-2020-05] SuiteCRM <= 7.11.10 Multiple SQL Injection
 Vulnerabilities

----------------------------------------------------------
SuiteCRM <= 7.11.10 Multiple SQL Injection Vulnerabilities
----------------------------------------------------------

[-] Software Link:

https://suitecrm.com/

[-] Affected Versions:

Version 7.11.10 and prior versions.

[-] Vulnerabilities Description:

1) The vulnerability is located within the SOAP API, specifically into 
the set_entries() SOAP
function. User input passed through the "name_value_lists" parameter 
(specifically the "first_name"
and "last_name" elements) isn’t properly sanitized before being used to 
construct a SQL query from
within the check_for_duplicate_contacts() function. This can be 
exploited by malicious users to e.g.
read sensitive data from the database through in-bound SQL injection 
attacks.

2) The vulnerability is located within the EmailUIAjax interface. User 
input passed through the
"bean_module" and "bean_id" parameters when handling the "addContact" 
action isn’t properly sanitized
before being used to construct a SQL query. This can be exploited by 
malicious users to read sensitive
data from the database through boolean-based SQL injection attacks.

3) The vulnerability is located within the EmailUIAjax interface. User 
input passed through the
"contactData" parameter when handling the "addContactsMultiple" action 
isn’t properly sanitized
before being used to construct a SQL query. This can be exploited by 
malicious users to read
sensitive data from the database through boolean-based SQL injection 
attacks.

4) The vulnerability is located within the EmailUIAjax interface. User 
input passed through the "ids"
parameter when handling the "removeContact" action isn’t properly 
sanitized before being used to
construct a SQL query. This can be exploited by malicious users to read 
sensitive data from the database
through time-based SQL injection attacks.

5) The vulnerability is located within the MailMerge module. User input 
passed through the "rel_module"
parameter when handling the "search" action isn’t properly sanitized 
before being used to construct a
SQL query. This can be exploited by malicious users to read sensitive 
data from the database through
time-based SQL injection attacks.

[-] Solution:

Upgrade to version 7.11.11 or later.

[-] Disclosure Timeline:

[19/09/2019] - Vendor notified
[20/09/2019] - Vendor acknowledgement
[12/11/2019] - Vendor contacted again asking for updates, no response
[20/01/2020] - Vendor notified about public disclosure intention, no 
response
[07/02/2020] - CVE number assigned
[10/02/2020] - Version 7.11.11 released
[12/02/2020] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2020-8804 to these vulnerabilities.

[-] Credits:

Vulnerabilities discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2020-05

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives