Critical SQL Injection in Customer Support System 1.0

CVE-2023-49970 is a critical SQL injection vulnerability affecting Customer Support System version 1.0. The vulnerability exists within the 'save_ticket' operation, specifically within the 'subject' parameter handled by the '/customer_support/ajax.php' endpoint. An unauthenticated attacker can supply crafted input containing SQL syntax to manipulate database queries. Given the application's design, this vulnerability allows for unauthorized data access, modification, or potential full database compromise. The availability of public exploit code targeting this specific parameter significantly increases the risk to organizations running this software.

Attack Chain

1. Attacker navigates to the public-facing ticketing portal (/customer_support/index.php?page=new_ticket).
2. Attacker prepares a POST request to the '/customer_support/ajax.php' endpoint.
3. Attacker targets the 'action=save_ticket' parameter to initiate the ticket creation process.
4. Attacker injects a malicious SQL payload into the 'subject' field, such as a time-based blind SQL injection string like "'+(select*from(select(sleep(5)))a)+'".
5. The application fails to sanitize the input, passing the concatenated SQL string directly to the backend MySQL database.
6. The database executes the injected command, leading to unauthorized operations or data exfiltration.

Impact

Successful exploitation of this vulnerability results in full compromise of the application's backend database. Attackers can exfiltrate sensitive customer support data, modify ticket records, or potentially perform administrative actions within the application. This poses a significant threat to the confidentiality, integrity, and availability of information stored within the Customer Support System.

Recommendation

Prioritize the identification and patching of all instances of the Customer Support System version 1.0. Until a patch is applied, restrict access to the '/customer_support/' directory via WAF rules to prevent unauthorized HTTP POST requests to the 'ajax.php' endpoint. Deploy the provided Sigma rule to detect attempts at SQL injection via the 'subject' parameter.