CVE-2021-38145
📋 TL;DR
This SQL injection vulnerability in Form Tools allows low-privileged client users to execute arbitrary SQL commands via the export_group_id parameter. Attackers can potentially access, modify, or delete database content, including sensitive form data and user credentials. All Form Tools installations up to version 3.0.20 with client accounts are affected.
💻 Affected Systems
- Form Tools
📦 What is this software?
Core by Formtools
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation to admin, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive form submission data, exposure of user information, and potential modification of form data.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, restricting SQL execution to read-only operations.
🎯 Exploit Status
Exploitation requires client-level credentials. Public proof-of-concept demonstrates SQL injection via export_group_id parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.21 or later
Vendor Advisory: https://github.com/formtools/core/
Restart Required: No
Instructions:
1. Backup your Form Tools installation and database. 2. Download latest version from formtools.org. 3. Replace core files with patched version. 4. Verify export functionality works correctly.
🔧 Temporary Workarounds
Disable Export Manager Module
linuxTemporarily disable the vulnerable export_manager module to prevent exploitation
mv modules/export_manager modules/export_manager.disabled
Restrict Client Export Permissions
allRemove export permissions from all client accounts in Form Tools admin panel
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns in export_group_id parameter
- Restrict network access to Form Tools installation to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if version is 3.0.20 or earlier and export_manager module exists at modules/export_manager/export.phpCheck Version:
grep "define('CORE_VERSION'" core/global/code/Config.class.phpVerify Fix Applied:
Verify version is 3.0.21+ and test export functionality with SQL injection payloads in export_group_id parameter📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple export requests with numeric parameters from single client
- Export requests with suspicious parameter values
Network Indicators:
- HTTP requests to export.php with SQL keywords in parameters
- Unusual database query patterns from web application
SIEM Query:
source="web_logs" AND uri="*export.php*" AND (param="*export_group_id=*UNION*" OR param="*export_group_id=*SELECT*" OR param="*export_group_id=*INSERT*")🔗 References
- https://bernardofsr.github.io/blog/2021/form-tools/
- https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.md
- https://github.com/formtools/core/
- https://www.formtools.org/
- https://bernardofsr.github.io/blog/2021/form-tools/
- https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.md
- https://github.com/formtools/core/
- https://www.formtools.org/
