CVE-2020-18175
📋 TL;DR
This CVE describes a SQL injection vulnerability in Metinfo CMS version 6.1.3 that allows attackers to execute arbitrary SQL commands via the dosafety_emailadd action in basic.php. This affects all Metinfo 6.1.3 installations with the vulnerable component enabled. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- Metinfo CMS
📦 What is this software?
Metinfo by Metinfo
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited with readily available tools and techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.0 or later
Vendor Advisory: https://www.metinfo.cn/download/
Restart Required: No
Instructions:
1. Backup your current installation and database. 2. Download the latest version from the official Metinfo website. 3. Replace the vulnerable basic.php file with the patched version. 4. Verify the fix by testing the dosafety_emailadd functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter SQL injection attempts in the dosafety_emailadd parameter
# Add input sanitization in basic.php before processing dosafety_emailadd
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
# Example ModSecurity rule: SecRule ARGS:dosafety_emailadd "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Disable or restrict access to the vulnerable basic.php endpoint
- Implement strict input validation and parameterized queries for all user inputs
🔍 How to Verify
Check if Vulnerable:
Test the dosafety_emailadd parameter with SQL injection payloads like ' OR '1'='1Check Version:
Check Metinfo version in admin panel or via /admin/index.php?lang=usVerify Fix Applied:
Attempt SQL injection on the patched dosafety_emailadd parameter and verify it's blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts after SQL injection attempts
- HTTP requests containing SQL keywords in dosafety_emailadd parameter
Network Indicators:
- HTTP POST requests to basic.php with SQL injection patterns
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*/basic.php*" AND (request="*dosafety_emailadd*SELECT*" OR request="*dosafety_emailadd*UNION*" OR request="*dosafety_emailadd*OR*1=1*")