CVE-2020-12606
📋 TL;DR
This vulnerability allows unauthenticated SQL injection in DB Soft SGLAC web frontend, enabling attackers to execute arbitrary SQL commands including operating system commands via xp_cmdshell. It affects all SGLAC web frontend deployments before version 20.05.001.
💻 Affected Systems
- DB Soft SGLAC
📦 What is this software?
Sglac by Dbsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with full administrative control over the SQL Server and underlying operating system, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Database compromise leading to data theft, privilege escalation, and potential command execution on the database server.
If Mitigated
Limited impact with proper network segmentation, database hardening, and monitoring in place.
🎯 Exploit Status
Public exploit code available in GitHub advisory. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.05.001
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Contact DB Soft for patch 20.05.001. 2. Apply patch to SGLAC web frontend. 3. Restart the SGLAC service. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Disable xp_cmdshell
windowsPrevents command execution via SQL injection but doesn't fix the SQL injection vulnerability itself.
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;
Network segmentation
allRestrict access to SGLAC web frontend to trusted networks only.
🧯 If You Can't Patch
- Implement web application firewall with SQL injection rules
- Disable or restrict access to the SVCManejador.svc endpoint
🔍 How to Verify
Check if Vulnerable:
Test the ProcedimientoGenerico method in SVCManejador.svc with SQL injection payloads. Check SGLAC version against vulnerable range.Check Version:
Check SGLAC web interface or configuration files for version information.Verify Fix Applied:
Verify SGLAC version is 20.05.001 or later. Test that SQL injection attempts no longer succeed.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- xp_cmdshell execution attempts
- HTTP requests to SVCManejador.svc with SQL syntax
Network Indicators:
- HTTP POST requests to /SVCManejador.svc containing SQL keywords
- Outbound connections from SQL Server to unexpected destinations
SIEM Query:
source="web_logs" AND uri="/SVCManejador.svc" AND (payload CONTAINS "xp_cmdshell" OR payload CONTAINS "UNION" OR payload CONTAINS "SELECT" FROM)