Attack Chain

1. An authenticated attacker identifies the vulnerable zpro.php endpoint.
2. The attacker crafts a malicious SQL payload designed to extract sensitive information.
3. The attacker injects the SQL payload into the zProIdPro parameter within a GET request to zpro.php.
4. The server-side application fails to properly sanitize the input, passing the malicious SQL query to the database.
5. The database executes the injected SQL query.
6. The database returns the results of the query, which may include usernames, database schemas, or version information.
7. The attacker captures the sensitive information from the HTTP response.
8. The attacker uses the extracted information to further compromise the system or gain unauthorized access to other resources.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2018-25429) in Paroiciel 11.20 can lead to the disclosure of sensitive database information. This could include usernames, passwords, database schemas, and other confidential data. The CVSS v3.1 score of 7.1 reflects the high potential for confidentiality impact and the potential for limited data modification. If successfully exploited, attackers can escalate privileges or gain unauthorized access to sensitive data, leading to data breaches and reputational damage.

Recommendation

• Deploy the Sigma rule provided to detect potential SQL injection attempts targeting the zProIdPro parameter in zpro.php.
• Apply input validation and sanitization to the zProIdPro parameter in zpro.php to prevent SQL injection, addressing CVE-2018-25429.
• Monitor web server logs for suspicious GET requests to zpro.php containing potentially malicious SQL payloads in the zProIdPro parameter.