CVE-2020-20473
📋 TL;DR
White Shark System (WSS) 1.3.2 contains a SQL injection vulnerability in multiple PHP files that fail to properly filter the 'sort' parameter. Remote attackers can exploit this to extract sensitive database information. Organizations running WSS 1.3.2 are affected.
💻 Affected Systems
- White Shark System (WSS)
📦 What is this software?
White Shark Systems by White Shark Systems Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, sensitive project data, and system configuration information leading to full system takeover.
Likely Case
Extraction of database contents including user information, project details, and potentially authentication data.
If Mitigated
Limited or no data exposure if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
Public proof-of-concept available on GitHub. SQL injection via sort parameter is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Implement input validation and parameterized queries in affected PHP files.
🔧 Temporary Workarounds
Input Validation for Sort Parameter
allAdd input validation to ensure sort parameter contains only allowed values
Modify affected PHP files to validate sort parameter against whitelist of allowed values
Web Application Firewall (WAF)
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate WSS system from internet access
- Implement strict network segmentation and monitor for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Check if WSS version is 1.3.2 and examine control_task.php, control_project.php, default_user.php files for sort parameter handlingCheck Version:
Check WSS configuration files or admin panel for version informationVerify Fix Applied:
Test sort parameter with SQL injection payloads to ensure proper filtering📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with SQL-like patterns in sort parameter
Network Indicators:
- HTTP requests containing SQL keywords in sort parameter
- Unusual database connection patterns
SIEM Query:
http.uri contains "sort=" AND (http.uri contains "UNION" OR http.uri contains "SELECT" OR http.uri contains "INSERT" OR http.uri contains "DELETE")