CVE-2017-15381
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the zip code search functionality in E-Sic 1.0. It affects organizations using the E-Sic software for electronic information access systems. Attackers can manipulate the 'f' parameter to inject malicious SQL queries.
💻 Affected Systems
- E-Sic
📦 What is this software?
E Sic by Softwarepublico
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation within the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Public exploit code is available and demonstrates simple SQL injection via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Review the vulnerable file: esiclivre/restrito/inc/buscacep.php
2. Replace raw SQL queries with parameterized/prepared statements
3. Implement proper input validation and sanitization
4. Test the fix thoroughly before deployment
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in the 'f' parameter
# Example ModSecurity rule:
SecRule ARGS:f "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
Input Validation Filter
linuxAdd input validation to only accept valid zip code formats
# PHP example:
$zipcode = preg_replace('/[^0-9]/', '', $_GET['f']);
if(strlen($zipcode) != 8) { die('Invalid zip code'); }
🧯 If You Can't Patch
- Block external access to the vulnerable endpoint using network ACLs or web server configuration
- Implement database-level controls: restrict application database user permissions to SELECT only
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: http://[target]/esiclivre/restrito/inc/buscacep.php?f=1' OR '1'='1Check Version:
Check the software version in configuration files or about pagesVerify Fix Applied:
Attempt SQL injection tests and verify they are blocked or return error messages without executing📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web logs
- Multiple requests with SQL keywords in 'f' parameter
- Requests to buscacep.php with non-numeric parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, INSERT) in URL parameters
- Abnormal database query patterns from web server
SIEM Query:
source="web_logs" AND uri="*buscacep.php*" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*")