CVE-2020-18013
📋 TL;DR
This is a critical SQL injection vulnerability in Whatsns 4.0 that allows attackers to execute arbitrary SQL commands via the ip parameter in the admin_banned/add.htm endpoint. Attackers can potentially read, modify, or delete database contents, affecting all Whatsns 4.0 installations with the vulnerable endpoint accessible.
💻 Affected Systems
- Whatsns
📦 What is this software?
Whatsns by Whatsns
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, privilege escalation, or database manipulation leading to administrative control.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploitation requires admin access to reach the vulnerable endpoint, but SQL injection payloads are simple and well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for official patches from Whatsns developers. 2. If no patch available, implement input validation and parameterized queries. 3. Consider upgrading to a newer version if available.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the ip parameter to only accept valid IP address formats.
Modify index.php to validate ip parameter with regex: /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Add WAF rule: Block requests to */admin_banned/add.htm* containing SQL keywords like UNION, SELECT, INSERT, DELETE
🧯 If You Can't Patch
- Restrict access to the admin_banned/add.htm endpoint using IP whitelisting or authentication requirements.
- Implement database-level protections: Use least privilege database accounts and enable SQL injection prevention features.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: index.php?admin_banned/add.htm?ip=127.0.0.1' OR '1'='1Check Version:
Check Whatsns version in admin panel or configuration files; look for version 4.0 indicators.Verify Fix Applied:
Attempt SQL injection tests after implementing fixes; payloads should be rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin_banned/add.htm access
- IP parameter containing SQL keywords in web server logs
Network Indicators:
- HTTP requests to */admin_banned/add.htm* with suspicious parameters
- Unusual database traffic patterns from web server
SIEM Query:
source="web_logs" AND uri="*admin_banned/add.htm*" AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*")