Summar Employee Portal versions before 3.98.0 had a SQL injection vulnerability. This affects the Employee Directories feature of the software under the authenticated endpoint; thus, it enables an attacker to directly connect to the back-end database.
The function that was exploited was found in the URL /MemberPages/quienesquien.aspx. When using this URL, the POST parameter ctl00$ContentPlaceHolder1$filtroNombre has not been properly sanitized prior to allowing database queries to run against it, allowing for arbitrary SQL statements to be injected into the application.
Because the vulnerability is exploitable, it provided complete database access, allowing an attacker read access to records with sensitive information and the ability to create, update, or delete records. Testing showed that the back-end database is located on a Microsoft SQL Server, indicating that this vulnerability is easily automatable with a tool like sqlmap.
As AJAX requests are used to access this end-point, traffic associated with using these requests may appear routine and basic during casual review. Thus, the SQL injection vulnerability could easily be overlooked during basic testing; once an authenticated session is established, there are no special requirements for exploiting this vulnerability; a crafted POST request is sufficient.
Because the Summar Employee Portal is typically used to maintain employee records, a successful exploitation of this SQL injection could result in a complete loss of personal data associated with employees or internal organizational information or a total compromise of all the data associated with this application layer.
Organizations that are using the affected versions must upgrade as soon as possible and check their server logs for any unusual events related to quienesquien.aspx.
Summary of Technical Information
Covered Endpoint:
/MemberPages/quienesquien.aspx
Vulnerable Parameter:
ctl00$ContentPlaceHolder1$filtroNombre
Type of Attack:
Authenticated SQL injection (post-based)
Web Database:
Microsoft SQL Server
Example of the Command Using sqlmap:
sqlmap --random-agent -r req.sqli.xml \
-p 'ctl00%24ContentPlaceHolder1%24filtroNombre' \
--dbms="MSSQL"
The point at which the injection takes place is part of an identified employees' search AJAX POST request. After the request is made, the parameter is sent from the request directly to the application's back end without any form of validation.
Source: Exploit DB
