CVE-2020-13566
📋 TL;DR
This CVE describes a SQL injection vulnerability in phpGACL 3.3.7 that allows attackers to execute arbitrary SQL commands via specially crafted HTTP requests. The vulnerability exists in the admin/edit_group.php file when the 'action' parameter is set to 'Delete' and the 'delete_group' parameter contains malicious SQL. Organizations using vulnerable phpGACL versions are affected.
💻 Affected Systems
- phpGACL
📦 What is this software?
Openemr by Open Emr
Phpgacl by Phpgacl Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential privilege escalation to system-level access if database permissions allow.
Likely Case
Unauthorized access to sensitive data stored in the database, including user credentials, access control lists, and configuration data.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploitation requires access to the admin interface. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.8 or later
Vendor Advisory: https://github.com/phpGACL/phpGACL
Restart Required: No
Instructions:
1. Download phpGACL version 3.3.8 or later from the official repository. 2. Backup your current installation. 3. Replace the vulnerable files with the patched version. 4. Verify the admin/edit_group.php file has proper input validation.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd input validation to sanitize the delete_group parameter before processing
Edit admin/edit_group.php to add: $delete_group = (int)$_POST['delete_group']; before SQL query
Access Restriction
allRestrict access to admin/edit_group.php file
Add .htaccess with: Deny from all
Or configure web server to block access to the file
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns targeting the delete_group parameter
- Disable or remove the admin/edit_group.php file if not required for operations
🔍 How to Verify
Check if Vulnerable:
Check if phpGACL version is 3.3.7 and review admin/edit_group.php for lack of input validation on delete_group parameterCheck Version:
Check the version.php file or look for version information in the phpGACL installation directoryVerify Fix Applied:
Verify the installed version is 3.3.8 or later and check that admin/edit_group.php properly validates the delete_group parameter📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to admin/edit_group.php with action=Delete containing unusual characters in delete_group parameter
- Database error logs showing SQL syntax errors
Network Indicators:
- HTTP traffic containing SQL keywords (SELECT, UNION, etc.) in POST parameters
- Unusual database queries originating from web server
SIEM Query:
source="web_logs" AND uri="*/admin/edit_group.php" AND post_data="*action=Delete*" AND (post_data="*delete_group=*SELECT*" OR post_data="*delete_group=*UNION*")