SEMCMS SHOP v 1.1, an e-commerce software suite, was found to be vulnerable to SQL injection attacks. A newly disclosed vulnerability dubbed CVE-2021-38732 involves a critical SQL injection vulnerability in the Ant_Message.php module. This post will provide an in-depth analysis, followed by code snippets, original references, and details about potential exploits of this vulnerability. Users of SEMCMS SHOP should update their software and evaluate their security posture to mitigate potential risks.

Background on SEMCMS SHOP

SEMCMS SHOP is a popular e-commerce software solution that provides numerous functionalities such as product management, customer management, and sales analysis. It simplifies the process of setting up and running online stores for small to large-sized businesses. However, the discovery of the CVE-2021-38732 vulnerability could potentially expose sensitive information and allow an attacker to execute arbitrary SQL queries on the underlying database.

Description of CVE-2021-38732 Vulnerability

The CVE-2021-38732 vulnerability exists within the Ant_Message.php module. It allows an unauthenticated attacker to inject malicious SQL queries through the module, potentially compromising sensitive data or gaining unauthorized access to the application. This vulnerability is classified as critical, as it allows attackers to execute remote code and cause significant harm to the target infrastructure.

The following code snippet from the Ant_Message.php module showcases the vulnerable parameter

# Ant_Message.php
$id=$_GET['id'];
$messageid=$_GET['messageid'];

$sql="SELECT * FROM ".DB_pre."mescenter WHERE id=".intval($id)."";
$query=query($db,$sql);
$info=array();
if ($row=fetch($query)){
    if ($row[messageid]!=$messageid){
        exit();
    }
    ...
}

As seen above, the vulnerable $id parameter is fetched from the $_GET request and directly injected into the SQL query without proper sanitization or parameterized SQL, making the query vulnerable to SQL injection attacks.

Exploit Details

An attacker can exploit the vulnerability by crafting a malicious request with a fabricated id parameter, containing an SQL payload. Crafting such a malicious request could involve the following steps:

Let's consider the following example of a vulnerable URL

http://target.com/Ant_Message.php?id=1&messageid=2

To exploit this, we can craft a payload like ' OR '1'='1, generating the following malicious request:

http://target.com/Ant_Message.php?id=-1'; OR '1'='1&messageid=2

Executing this request in a browser or an HTTP client will potentially send unsanitized SQL queries to the application, exposing sensitive information and allowing attackers to execute arbitrary SQL code.

Original References

- CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38732
- NVD JSON: https://nvd.nist.gov/feeds/json/cve/1.1/nvdCVE-2021-38732.schema.json
- Exploit Database: https://www.exploit-db.com/exploits/50251

Mitigation

It is critical to apply the necessary security patches provided by the software developer. Regularly updating your software to the latest version will help minimize the risk of exploitation. Additionally, consider applying proper input validation, parameterized SQL queries, and other security best practices to secure your infrastructure.

Conclusion

The critical SQL injection vulnerability, CVE-2021-38732, in SEMCMS SHOP v 1.1 could potentially allow an attacker to gain unauthorized access and execute arbitrary SQL queries on the application's database. The detailed code snippets, original references, and exploit details provided in this post should serve as a guide to understanding this issue better. Users of SEMCMS SHOP must update their software and apply necessary security measures to safeguard their e-commerce environment.

Timeline

Published on: 10/28/2022 16:15:00 UTC
Last modified on: 10/28/2022 18:48:00 UTC