Attack Chain

1. An unauthenticated attacker identifies an eNdonesia Portal v8.7 instance.
2. The attacker crafts a malicious SQL payload designed to extract data from the INFORMATION_SCHEMA tables.
3. The attacker constructs a GET request targeting banners.php.
4. The crafted SQL payload is injected into the bid parameter of the GET request: banners.php?bid=<SQL_payload>.
5. The web server processes the request and executes the injected SQL query against the database.
6. The database returns the results of the SQL query, potentially including sensitive data or schema information.
7. The attacker receives the database response containing the extracted information.
8. The attacker analyzes the extracted information to further compromise the system or exfiltrate sensitive data.

Impact

Successful exploitation of this SQL injection vulnerability can lead to the unauthorized disclosure of sensitive data, including user credentials, financial information, and other confidential data stored in the eNdonesia Portal v8.7 database. The impact could range from defacement of the website to complete compromise of the underlying database server. Although the number of affected installations is unknown, any instance of eNdonesia Portal v8.7 is potentially vulnerable.

Recommendation

• Deploy the Sigma rule Detecting eNdonesia banners.php SQL Injection Attempt to your SIEM to identify exploitation attempts targeting the banners.php endpoint.
• Examine web server logs for GET requests to banners.php containing suspicious SQL syntax within the bid parameter (reference the log source in the Sigma rule).
• Apply available patches or updates for eNdonesia Portal v8.7 to remediate the CVE-2019-25643 vulnerability.