CVE-2023-7146

Executive Summary

CVE-2023-7146 is a critical SQL injection vulnerability discovered in the Gopeak MasterLab application, affecting versions up to and including 3.3.10. The flaw resides in the sqlInjectDelete function within the app/ctrl/framework/Feature.php file, specifically in the HTTP POST Request Handler. By manipulating the phone argument, an unauthenticated attacker can inject arbitrary SQL commands, leading to potential data exfiltration, modification, or deletion. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released by the vendor, making this a high-priority issue for any organization using MasterLab.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): Low – Limited service disruption is possible.

Threat Level: High due to public exploit availability and lack of a patch.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the sqlInjectDelete function of app/ctrl/framework/Feature.php. The function is designed to handle HTTP POST requests and delete records based on a phone parameter. However, the input is not properly sanitized or parameterized, allowing an attacker to inject SQL commands.

Vulnerable Code Path:

1. The application receives a POST request to the endpoint that triggers sqlInjectDelete.
2. The phone parameter is extracted from the request.
3. This parameter is directly concatenated into a SQL DELETE query without any sanitization or prepared statements.
4. The query is executed against the database, allowing the attacker to manipulate the SQL statement.

Example of vulnerable PHP code:

function sqlInjectDelete() {
    $phone = $_POST['phone'];
    $sql = "DELETE FROM users WHERE phone = '$phone'";
    $this->db->query($sql);
}

Exploitation Mechanics: An attacker can send a POST request with a malicious phone value, such as:

phone=123' OR '1'='1

This would result in the SQL query:

DELETE FROM users WHERE phone = '123' OR '1'='1'

Which would delete all records in the users table.

Vulnerable vs. Patched Code

Vulnerable Code (MasterLab <= 3.3.10):

function sqlInjectDelete() {
    $phone = $_POST['phone'];
    $sql = "DELETE FROM users WHERE phone = '$phone'";
    $this->db->query($sql);
}

Patched Code (Hypothetical):

function sqlInjectDelete() {
    $phone = $_POST['phone'];
    $stmt = $this->db->prepare("DELETE FROM users WHERE phone = ?");
    $stmt->bind_param("s", $phone);
    $stmt->execute();
}

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of MasterLab (<= 3.3.10) running on a target.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint. Typically, it is accessible via a POST request to a path like /index.php?c=framework&a=sqlInjectDelete.
2. Craft a malicious POST request with a manipulated phone parameter.
3. Use tools like curl or Burp Suite to send the request.

Example curl command:

curl -X POST http://target.com/index.php?c=framework&a=sqlInjectDelete \
  -d "phone=123' OR '1'='1"

Advanced Exploitation:

• Use SQL injection to extract data: phone=123' UNION SELECT username,password FROM users--
• Use time-based blind injection: phone=123' AND SLEEP(5)--

Note: No public exploit code from Exploit-DB was provided.

Blue Team

Detection:

• Monitor HTTP POST requests to the vulnerable endpoint for suspicious phone parameters.
• Look for SQL keywords like OR, AND, UNION, SELECT, SLEEP, etc., in the phone parameter.
• Use Web Application Firewall (WAF) rules to block common SQL injection patterns.

Mitigation:

• Immediately upgrade to a patched version if available.
• If no patch is available, implement a virtual patch using a WAF.
• Restrict network access to the MasterLab application.
• Conduct a thorough review of the codebase for similar vulnerabilities.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /index.php?c=framework&a=sqlInjectDelete with abnormal phone parameters.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
  • Unusual database queries (e.g., DELETE FROM users WHERE 1=1).

• File IOCs:

  • Modified or deleted user records in the database.
  • Suspicious entries in web server logs (e.g., POST /index.php?c=framework&a=sqlInjectDelete with SQL injection patterns).

• Behavioral IOCs:

  • Unexpected database activity, such as mass deletion of records.
  • Unauthorized data extraction attempts.

Detection Engineering

YARA Rule

rule CVE_2023_7146_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-7146 in MasterLab"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7146"
    strings:
        $sqli1 = "sqlInjectDelete" nocase
        $sqli2 = "phone=" nocase
        $sqli3 = /phone=.*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-7146 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against MasterLab's sqlInjectDelete function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'c=framework&a=sqlInjectDelete'
        cs-uri-query|contains: 'phone='
    keywords:
        - 'OR'
        - 'AND'
        - 'UNION'
        - 'SELECT'
        - 'SLEEP'
        - 'BENCHMARK'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word 'OR' in a phone number (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7146 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php";
    http_uri;
    content:"c=framework&a=sqlInjectDelete";
    http_uri;
    content:"phone=";
    http_client_body;
    pcre:"/phone=.*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-7146;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the MasterLab application from the internet if possible.
2. Implement a WAF rule to block SQL injection patterns in the phone parameter.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• Patch: No official patch is available. Contact Gopeak for an update or consider migrating to an alternative solution.
• Code Fix: If you have access to the source code, apply the patched code example provided in the "Vulnerable vs. Patched Code" section.
• Upgrade: If a newer version is released, upgrade immediately.

Compensating Controls:

• Use a database firewall to monitor and block malicious queries.
• Implement strict input validation and output encoding.
• Apply the principle of least privilege to database accounts.

Valters IT
Securing Digital Frontiers