Talos Vulnerability Report

TALOS-2019-0902

Forma LMS 2.2.1 ajax.adm_server.php dir parameter SQL injections

December 2, 2019
CVE Number

CVE-2019-5109

Summary

Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.

Tested Versions

Forma LMS 2.2.1

Product URLs

https://www.formalms.org/

CVSSv3 Score

7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Details

An SQL injection vulnerability exists in Forma LMS 2.2.1. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.

The /appCore/ajax.adm_server.php URL and parameter dir have been confirmed to suffer from SQL injections and could be exploited by authenticated attackers:

POST /appCore/ajax.adm_server.php?r=alms/enrollrules/get HTTP/1.1
Host: [IP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://[IP]/appCore/index.php?r=alms/enrollrules/show
X-Requested-With: XMLHttpRequest
X-Signature: [SIG]
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 76
DNT: 1
Connection: close
Cookie: docebo_session=[SESSIONID]; 11836.my_course.type=elearning; 11836.my_course.category=0; 11836.my_course.year=0; catalog[0].type_course=classroom

sort=title&dir=asc[SQLINJECTION]&startIndex=0&results=1

Timeline

2019-09-19 - Vendor Disclosure
2019-11-29 - Vendor patched
2019-12-02 - Public Release

Credit

Discovered by Yuri Kramarz of Security Advisory EMEAR.