CVE-2020-13968
📋 TL;DR
This vulnerability allows SQL injection attacks via the 'strSessao' parameter in CRK Business Platform. Attackers can execute arbitrary SQL commands against the database, potentially compromising data confidentiality, integrity, and availability. All users of CRK Business Platform version 2019.1 and earlier are affected.
💻 Affected Systems
- CRK Business Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution on the underlying server.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Public Nmap NSE script available for exploitation. SQL injection via URL parameter makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://crk.com.br/produtos/
Restart Required: No
Instructions:
1. Contact CRK vendor for updated version
2. Apply vendor-provided patch
3. Test in non-production environment first
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Input Validation Filter
allImplement server-side filtering for 'strSessao' parameter
🧯 If You Can't Patch
- Isolate the CRK Business Platform behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from application servers
🔍 How to Verify
Check if Vulnerable:
Use the Nmap NSE script from GitHub repository to test for vulnerabilityCheck Version:
Check CRK Business Platform version in admin interface or configuration filesVerify Fix Applied:
Retest with NSE script after applying fixes; verify no SQL injection payloads succeed📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection payloads in 'strSessao' parameter
SIEM Query:
source="web_logs" AND (strSessao CONTAINS "UNION" OR strSessao CONTAINS "SELECT" OR strSessao CONTAINS "INSERT")