CVE-2021-29350
📋 TL;DR
This SQL injection vulnerability in the 发货100-设计素材下载系统 (Delivery 100 - Design Material Download System) allows remote attackers to execute arbitrary SQL commands by manipulating the X-Forwarded-For HTTP header. Attackers can potentially access, modify, or delete database content. All users running version 1.1 of this software are affected.
💻 Affected Systems
- 发货100-设计素材下载系统 (Delivery 100 - Design Material Download System)
📦 What is this software?
Shipment 100 Design Material Download System by Shipment 100 Design Material Download System Project
View all CVEs affecting Shipment 100 Design Material Download System →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation within the application database.
If Mitigated
Attack blocked at web application firewall or network perimeter with SQL injection detection.
🎯 Exploit Status
Exploitation requires sending HTTP requests with malicious X-Forwarded-For headers to the vulnerable endpoint. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If no patch exists, implement input validation and parameterized queries in conn/function.php. 3. Sanitize X-Forwarded-For header values before database queries.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock or sanitize malicious SQL patterns in X-Forwarded-For headers
WAF-specific configuration required
Input Validation
allAdd validation to only accept valid IP addresses in X-Forwarded-For header
Modify conn/function.php to validate IP format before database queries
🧯 If You Can't Patch
- Block external access to admin/product_add.php endpoint using firewall rules
- Implement network segmentation to isolate the vulnerable system from sensitive data
🔍 How to Verify
Check if Vulnerable:
Send HTTP request to admin/product_add.php with X-Forwarded-For header containing SQL injection payload and observe database errors or unexpected behavior.Check Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Test with same SQL injection payloads and verify they are rejected or sanitized without affecting database.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from web server IP
- Multiple failed login attempts following SQL errors
Network Indicators:
- HTTP requests to admin/product_add.php with SQL patterns in headers
- Unusual database traffic patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/product_add.php" AND (header="*X-Forwarded-For*" AND header="*SELECT* OR *UNION* OR *INSERT* OR *DELETE*")