CVE-2021-41609
📋 TL;DR
This is a critical SQL injection vulnerability in SelectSurvey.NET that allows unauthenticated remote attackers to extract sensitive data from the backend database. Attackers can use boolean-based blind and UNION injection techniques to retrieve information. All organizations running vulnerable versions of SelectSurvey.NET are affected.
💻 Affected Systems
- SelectSurvey.NET
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of sensitive survey data, user credentials, PII, and potential lateral movement to other systems.
Likely Case
Data exfiltration of survey responses, user information, and potentially authentication credentials from the database.
If Mitigated
Limited impact with proper WAF rules, input validation, and database permissions restricting sensitive data access.
🎯 Exploit Status
SQL injection techniques are well-documented and tools like sqlmap can automate exploitation. The vulnerability requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.052.000 and later
Vendor Advisory: https://www.classapps.com/product_ssv5.aspx
Restart Required: Yes
Instructions:
1. Download SelectSurvey.NET version 5.052.000 or later from ClassApps. 2. Backup current installation and database. 3. Install the updated version following vendor instructions. 4. Restart IIS/application services. 5. Verify the patch is applied by checking version.
🔧 Temporary Workarounds
WAF Rule Implementation
allImplement Web Application Firewall rules to block SQL injection patterns targeting the UploadedImageDisplay.aspx endpoint
WAF-specific rules to block SQL injection patterns in ID parameter
Endpoint Restriction
windowsRestrict access to UploadedImageDisplay.aspx endpoint using firewall rules or authentication
IIS URL Rewrite rule to block or require auth for UploadedImageDisplay.aspx
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for the ID parameter in UploadedImageDisplay.aspx
- Deploy a WAF with SQL injection protection rules and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Test the UploadedImageDisplay.aspx endpoint with SQL injection payloads in the ID parameter or check application versionCheck Version:
Check application version in admin interface or web.config fileVerify Fix Applied:
Verify version is 5.052.000 or later and test that SQL injection attempts no longer succeed📡 Detection & Monitoring
Log Indicators:
- SQL error messages in IIS logs
- Multiple requests to UploadedImageDisplay.aspx with suspicious ID parameters
- UNION SELECT patterns in URL parameters
Network Indicators:
- SQL injection patterns in HTTP requests to UploadedImageDisplay.aspx
- Database connection spikes from web server
SIEM Query:
source="IIS" AND url="*UploadedImageDisplay.aspx*" AND (url="*UNION*" OR url="*SELECT*" OR url="*OR*1=1*")🔗 References
- https://www.classapps.com/product_ssv5.aspx
- https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure
- https://www.classapps.com/product_ssv5.aspx
- https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure
