CVE-2019-5111 - CVE-2019-5112
Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.
Forma LMS 2.2.1
7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
An SQL injection vulnerability exists in Forma LMS 2.2.1. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.
The /appLms/ajax.server.php
URL and parameters filter_cat
and filter_status
have been confirmed to suffer from SQL injections and could be exploited by authenticated attackers.
Parameter filter_cat
:
GET /appLms/ajax.server.php?r=elearning/all&rnd=1561652923&filter_text=&filter_type=elearning&filter_cat=[SQLINJECTION]&filter_status=all&filter_year=0 HTTP/1.1
Host: [IP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://[IP]/appLms/index.php?r=elearning/show
X-Signature: [SIG]
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: docebo_session=[SESSIONID]; 11836.my_course.type=elearning; 11836.my_course.category=0; 11836.my_course.year=0
Parameter filter_status
:
GET /appLms/ajax.server.php?r=elearning/all&rnd=1561652923&filter_text=&filter_type=elearning&filter_cat=0&filter_status=[SQLINJECTION]&filter_year=0 HTTP/1.1
Host: [IP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://[IP]/appLms/index.php?r=elearning/show
X-Signature: [SIG]
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: docebo_session=[SESSIONID]; 11836.my_course.type=elearning; 11836.my_course.category=0; 11836.my_course.year=0
2019-09-19 - Vendor Disclosure
2019-11-29 - Vendor patched
2019-12-02 - Public Release
Discovered by Yuri Kramarz of Security Advisory EMEAR.