CVE-2018-16659
📋 TL;DR
CVE-2018-16659 is a critical SQL injection vulnerability in Rausoft ID.prove 2.95 that allows attackers to execute arbitrary SQL commands via the login page's Username parameter. This can lead to authentication bypass, data theft, and remote code execution through SQL Server's xp_cmdshell. Organizations using Rausoft ID.prove 2.95 are affected.
💻 Affected Systems
- Rausoft ID.prove
📦 What is this software?
Id.prove by Rausoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via xp_cmdshell leading to domain takeover, data exfiltration, and ransomware deployment.
Likely Case
Authentication bypass leading to unauthorized access, sensitive data extraction, and potential lateral movement.
If Mitigated
Limited to SQL injection without command execution if xp_cmdshell is disabled and proper input validation exists.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB. Attack requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - No official patch documented
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
1. Upgrade to a newer version if available. 2. Apply input validation and parameterized queries. 3. Disable xp_cmdshell in SQL Server.
🔧 Temporary Workarounds
Disable xp_cmdshell
windowsPrevents command execution via SQL injection by disabling the dangerous stored procedure
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;
Implement WAF Rules
allBlock SQL injection patterns at the web application firewall
🧯 If You Can't Patch
- Isolate the ID.prove server in a restricted network segment
- Implement strict input validation and parameterized queries in the application code
🔍 How to Verify
Check if Vulnerable:
Test login page with SQL injection payload: ' OR '1'='1 in Username fieldCheck Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Verify parameterized queries are implemented and xp_cmdshell is disabled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Failed login attempts with SQL syntax
- xp_cmdshell execution events
Network Indicators:
- POST requests to login page with SQL payloads
- Outbound connections from SQL Server to unexpected destinations
SIEM Query:
source="web_logs" AND uri="/login" AND (body CONTAINS "xp_cmdshell" OR body CONTAINS "UNION" OR body CONTAINS "SELECT @@version")