CVE-2021-44348
📋 TL;DR
This CVE describes a SQL injection vulnerability in TuziCMS v2.0.6 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the AdvertController. This affects all TuziCMS v2.0.6 installations and could lead to complete database compromise.
💻 Affected Systems
- TuziCMS
📦 What is this software?
Tuzicms by Yejiao
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and tools like sqlmap can automate exploitation. The GitHub issue shows proof of concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.0.7 or later
Vendor Advisory: https://github.com/yeyinshi/tuzicms/issues/9
Restart Required: No
Instructions:
1. Backup your current installation and database. 2. Download the latest version from the official repository. 3. Replace vulnerable files with patched versions. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter before processing
Modify App\Manage\Controller\AdvertController.class.php to validate/sanitize the id parameter
WAF Rule
allImplement Web Application Firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in id parameter
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the affected controller
- Restrict access to the vulnerable endpoint using network controls or authentication
🔍 How to Verify
Check if Vulnerable:
Test the AdvertController endpoint with SQL injection payloads in the id parameter (e.g., id=1' OR '1'='1)Check Version:
Check TuziCMS version in configuration files or admin panelVerify Fix Applied:
Test the same endpoint with SQL injection payloads after patching - should return error or no data leakage📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts following SQL errors
- Requests with SQL keywords in id parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in parameters
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND (uri_query="*id=*'*" OR uri_query="*id=*%27*")