CVE-2020-22212
📋 TL;DR
This is a critical SQL injection vulnerability in 74cms version 3.2.0 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the wap/wap-company-show.php endpoint. Attackers can potentially read, modify, or delete database content, including sensitive user data. All organizations running vulnerable versions of 74cms are affected.
💻 Affected Systems
- 74cms
📦 What is this software?
74cms by 74cms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution through database functions.
Likely Case
Unauthorized access to sensitive data including user credentials, personal information, and business data stored in the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Simple SQL injection via GET parameter with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.2.0
Vendor Advisory: https://github.com/blindkey/cve_like/issues/14
Restart Required: No
Instructions:
1. Upgrade to the latest version of 74cms. 2. Apply vendor patches if available. 3. Replace vulnerable file with patched version if patch is provided.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter before processing
// PHP code to validate id parameter
if (!is_numeric($_GET['id']) || $_GET['id'] <= 0) {
die('Invalid parameter');
}
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
# Example ModSecurity rule
SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Block access to /wap/wap-company-show.php at network perimeter or web server level
- Implement strict input validation and parameterized queries for all database interactions
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payload: /wap/wap-company-show.php?id=1' OR '1'='1Check Version:
Check 74cms version in admin panel or read version file if availableVerify Fix Applied:
Test with same payload after patching - should return error or no database errors📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from web server IP
- Multiple requests to wap-company-show.php with suspicious id parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in id parameter
- Abnormal response patterns from vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/wap/wap-company-show.php" AND (query="*id=*'*" OR query="*id=*%27*")