CVE-2021-37291
📋 TL;DR
This SQL injection vulnerability in KevinLAB Inc Building Energy Management System allows attackers to execute arbitrary SQL commands through the input_id POST parameter in index.php. Attackers could potentially access, modify, or delete sensitive building management data. Organizations using version 1.0.0 of this BEMS software are affected.
💻 Affected Systems
- KevinLAB Inc Building Energy Management System 4ST BEMS
📦 What is this software?
4st L Bems by Kevinlab
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the BEMS database including sensitive building control data, potential manipulation of building systems, and lateral movement to other network segments.
Likely Case
Data exfiltration of building energy data, user credentials, and system configuration information leading to operational disruption.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
SQL injection via POST parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.kevinlab.com
Restart Required: No
Instructions:
1. Contact KevinLAB Inc for patch availability 2. Apply vendor-provided patch 3. Test in non-production environment first 4. Deploy to production systems
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the input_id parameter
Input Validation Filter
allImplement server-side input validation to sanitize the input_id parameter
🧯 If You Can't Patch
- Isolate the BEMS system on a separate network segment with strict firewall rules
- Implement database-level protections: use least privilege accounts, enable SQL injection prevention features
🔍 How to Verify
Check if Vulnerable:
Test the index.php endpoint with SQL injection payloads in the input_id POST parameter and observe database errors or unexpected responsesCheck Version:
Check system documentation or web interface for version informationVerify Fix Applied:
Retest with SQL injection payloads after applying fixes; successful payloads should be rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts or parameter manipulation
- Unexpected database queries
Network Indicators:
- POST requests to index.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*/index.php" AND (param="input_id" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "' OR '")