[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

2015-06-1400:00:00

vulners.com

147

JSON

Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

[-] Software Link:

https://www.concrete5.org/

[-] Affected Versions:

Version 5.7.3.1, 5.7.4, and probably other versions.

[-] Vulnerability Description:

The vulnerable code is located in /concrete/src/Permission/Access/Access.php:

protected function buildAssignmentFilterString($accessType, $filterEntities)
{
```
   $peIDs = &#39;&#39;;
```
```
   $filters = array&#40;&#41;;
```

   if &#40;count&#40;$filterEntities&#41; &gt; 0&#41; {

       foreach &#40;$filterEntities as $ent&#41; {

           $filters[] = $ent-&gt;getAccessEntityID&#40;&#41;;

```
       }
```

       $peIDs .= &#39;and peID in &#40;&#39; . implode&#40;$filters, &#39;,&#39;&#41; . &#39;&#41;&#39;;

```
   }
```
```
   if &#40;$accessType == 0&#41; {
```
```
       $accessType = &#39;&#39;;
```
```
   } else {
```

       $accessType = &#39; and accessType = &#39; . $accessType;

```
   }
```

The Access::buildAssignmentFilterString() method uses its $accessType parameter to construct a SQL query
without a proper validation at line 181. This can be exploited to inject and execute arbitrary SQL commands.
Successful exploitation of this vulnerability requires an account with privileges to edit page permissions.

[-] Solution:

Update to version 5.7.4.1 or later.

[-] Disclosure Timeline:

[05/05/2015] - Vulnerability details sent through HackerOne
[12/05/2015] - Vendor said a patch has been committed and will be available in the next version
[12/05/2015] - Version 5.7.4.1 released along with the patch for this vulnerability
[11/06/2015] - Vulnerability publicly disclosed on HackerOne
[11/06/2014] - CVE number requested
[11/06/2014] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a name to this vulnerability yet.

[-] Credits:

Vulnerability discovered by Egidio Romano of Minded Security.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2015-03

[-] Other References:

https://hackerone.com/reports/59664

JSON

[KIS-2015-03] Concrete5 &lt;= 5.7.4 &#40;Access.php&#41; SQL Injection Vulnerability

Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability