CVE-2020-20392
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in imcat v5.2 that allows attackers to execute arbitrary SQL commands through the fm[auser] parameter in coms/add_coms.php. Any system running the vulnerable imcat version is affected, potentially allowing complete database compromise.
💻 Affected Systems
- imcat
📦 What is this software?
Imcat by Txjia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, data exfiltration, and privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
SQL injection via fm[auser] parameter is straightforward to exploit with common SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.3 or later
Vendor Advisory: https://github.com/peacexie/imcat/issues/5
Restart Required: No
Instructions:
1. Upgrade imcat to version 5.3 or later. 2. Replace the vulnerable coms/add_coms.php file with the patched version. 3. Verify the fix by testing the fm[auser] parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the fm[auser] parameter before processing.
Modify coms/add_coms.php to include: $fm_auser = mysqli_real_escape_string($connection, $_POST['fm']['auser']);
WAF Rule
allImplement web application firewall rules to block SQL injection patterns.
Add WAF rule: Detect and block requests containing SQL keywords in fm[auser] parameter
🧯 If You Can't Patch
- Disable or restrict access to the coms/add_coms.php endpoint
- Implement strict input validation and parameterized queries for all database operations
🔍 How to Verify
Check if Vulnerable:
Test the fm[auser] parameter in coms/add_coms.php with SQL injection payloads like ' OR '1'='1Check Version:
Check imcat version in configuration files or admin panelVerify Fix Applied:
Test the same parameter with SQL injection payloads and verify they are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests to coms/add_coms.php with SQL keywords in parameters
Network Indicators:
- HTTP POST requests to coms/add_coms.php containing SQL injection patterns
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/coms/add_coms.php" AND (param="%27OR%271%27%3D%271" OR param CONTAINS "UNION" OR param CONTAINS "SELECT")