The world of digital security is always changing, and new vulnerabilities are discovered every day. Today, we will discuss one such vulnerability designated as CVE-2021-38731, found in SEMCMS SHOP v 1.1. This particular vulnerability is a SQL Injection that can be exploited via Ant_Zekou.php. In this post, we will dive deep into the details of this vulnerability, explain how it can be exploited, and provide you with original references to help you better understand this issue. But first, let's start by understanding what SQL Injection is.

What is SQL Injection?

SQL Injection is a code injection technique used by hackers to exploit web applications that rely on a backend database. Attackers can use this technique to inject malicious SQL code into an application to gain unauthorized access to sensitive data or even execute arbitrary code on the backend system. This type of vulnerability can have severe consequences for the security and integrity of an application and the data it stores.

Now that we understand what SQL Injection is, let's move on to CVE-2021-38731.

CVE-2021-38731: SEMCMS SHOP v 1.1 SQL Injection Vulnerability
SEMCMS SHOP is an e-commerce platform that provides an easy-to-use solution for businesses looking to create an online store. Unfortunately, version 1.1 of this software contains a critical vulnerability that makes it susceptible to SQL Injection attacks.

This vulnerability can be exploited by sending specially crafted data to the Ant_Zekou.php file. The application fails to properly sanitize user input before using it in an SQL query, allowing an attacker to construct a malicious query that can lead to sensitive data exposure or even remote code execution. The code snippet below demonstrates this vulnerability:

// The relevant code from Ant_Zekou.php
$userok = @$_POST['userok'];
$passok = @$_POST['passok'];

$sql="select id,user,password from user where user = '$userok' and password = '$passok'";
query($sql);

As you can see, the values of userok and passok are directly inserted into the SQL query without any kind of sanitization or escaping. This can lead to injection of malicious SQL code that can manipulate the query executed by the application, compromising its security.

Original References

To further enhance your understanding of CVE-2021-38731, below are some original references that provide technical details about the vulnerability:

1. Official CVE Details
2. National Vulnerability Database (NVD) Entry

Exploit Details

To exploit this vulnerability, an attacker can send a POST request to the Ant_Zekou.php file containing specially crafted values for userok and passok. Since these values are inserted directly into the SQL query, they can be used to inject malicious SQL code that manipulates the query's behavior.

The following is a simple example of an exploit using this vulnerability

POST /Ant_Zekou.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

userok=admin'--&passok=anything

In this example, the attacker is leveraging a SQL comment (--) to essentially ignore the password check in the SQL query, allowing them to log in as the admin without knowing the actual password.

Conclusion

It is crucial for web application developers and administrators to be aware of the security implications of their software. In the case of SEMCMS SHOP v 1.1, the SQL Injection vulnerability (CVE-2021-38731) provides a clear example of the dangers associated with not properly validating and sanitizing user input. By understanding this vulnerability, taking appropriate steps to remedy it (such as updating to a patched version of the software or developing and deploying a fix), and learning from the mistakes leading to its creation, developers can build more secure applications and help protect their users' data.

Timeline

Published on: 10/28/2022 16:15:00 UTC
Last modified on: 10/28/2022 18:48:00 UTC