Attack Chain

1. An attacker authenticates to the No-CMS 1.0 application.
2. The attacker crafts a malicious POST request targeting the /nocms/main/manage_privilege/index/export endpoint.
3. The POST request includes a modified order_by[0] parameter containing malicious SQL code.
4. The application receives the request and processes the order_by[0] parameter without proper sanitization.
5. The unsanitized SQL code is injected into a database query executed by the application.
6. The attacker’s injected SQL code manipulates the query to extract sensitive information.
7. The database executes the modified query and returns the results to the application.
8. The application displays or otherwise exposes the extracted sensitive information to the attacker.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2018-25431) can lead to unauthorized access to sensitive data stored in the No-CMS database. This may include user credentials, personal information, financial records, or other confidential data. The impact of this vulnerability is high, as it allows an attacker with low privileges (authenticated user) to potentially compromise the entire database.

Recommendation

• Apply available patches or updates to No-CMS to remediate CVE-2018-25431.
• Deploy the Sigma rule “Detect CVE-2018-25431 Exploitation Attempt — No-CMS SQL Injection via order_by Parameter” to your SIEM to identify malicious POST requests.
• Implement input validation and sanitization measures to prevent SQL injection attacks in the order_by parameter.
• Monitor web server logs for suspicious POST requests to /nocms/main/manage_privilege/index/export containing SQL syntax in the order_by[0] parameter (see Sigma rule and logsource).
• Review and restrict database user privileges to minimize the impact of successful SQL injection attacks.