CVE-2021-26935
📋 TL;DR
This SQL injection vulnerability in WoWonder allows remote attackers to execute arbitrary SQL commands via the event_id parameter in the requests.php?f=search-my-followers endpoint. Successful exploitation could lead to complete database compromise, affecting all WoWonder installations running versions below 3.1.
💻 Affected Systems
- WoWonder
📦 What is this software?
Wowonder by Wowonder
⚠️ Risk & Real-World Impact
Worst Case
Complete database takeover including user credentials, personal data, and administrative access, potentially leading to full system compromise.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation to administrative accounts.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1
Vendor Advisory: https://www.wowonder.com/
Restart Required: No
Instructions:
1. Backup your WoWonder installation and database. 2. Download WoWonder version 3.1 or higher. 3. Replace all files with the new version. 4. Verify the patch is applied by checking the version.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the event_id parameter before processing.
Modify requests.php to validate event_id as integer: if(!is_numeric($_GET['event_id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns in the event_id parameter.
Add WAF rule: SecRule ARGS:event_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Block access to /requests.php endpoint at network perimeter or web server level.
- Implement strict input validation and parameterized queries for all user inputs.
🔍 How to Verify
Check if Vulnerable:
Check if WoWonder version is below 3.1 by examining the admin panel or version files.Check Version:
Check admin panel or examine WoWonder configuration files for version information.Verify Fix Applied:
Confirm version is 3.1 or higher and test the vulnerable endpoint with SQL injection payloads.📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Unusual database queries from web application
- Multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests to /requests.php?f=search-my-followers with SQL injection payloads in event_id parameter
SIEM Query:
source="web_server" AND url="*requests.php?f=search-my-followers*" AND (event_id="*' OR *" OR event_id="*;*" OR event_id="*UNION*" OR event_id="*SELECT*" OR event_id="*FROM*" OR event_id="*WHERE*")