CVE-2021-45794
📋 TL;DR
CVE-2021-45794 is an SQL injection vulnerability in Slims9 Bulian's backup.php module that allows attackers to execute arbitrary SQL commands. This can lead to unauthorized access to sensitive user data stored in the database. All systems running the vulnerable version with the backup module accessible are affected.
💻 Affected Systems
- Slims9 Bulian
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of all user credentials, personal data, and potential system takeover through privilege escalation.
Likely Case
Unauthorized access to user data including usernames, emails, and potentially hashed passwords from the database.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and tools exist for automated exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub repository for latest patched version
Vendor Advisory: https://github.com/slims/slims9_bulian/issues/124
Restart Required: No
Instructions:
1. Update to latest Slims9 Bulian version. 2. Apply security patches from GitHub repository. 3. Validate backup.php file has proper input sanitization.
🔧 Temporary Workarounds
Restrict Access to Backup Module
allBlock access to the vulnerable backup.php endpoint using web server configuration
# Apache: RewriteRule ^admin/modules/system/backup\.php$ - [F]
# Nginx: location ~ ^/admin/modules/system/backup\.php$ { return 403; }
Implement WAF Rules
allAdd SQL injection detection rules to web application firewall
# ModSecurity: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in backup.php
- Restrict database user permissions to minimum required for backup operations
🔍 How to Verify
Check if Vulnerable:
Test the backup.php endpoint with SQL injection payloads like ' OR '1'='1 in parametersCheck Version:
Check Slims9 version in system configuration or admin panelVerify Fix Applied:
Verify backup.php no longer accepts SQL injection payloads and uses parameterized queries📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by backup.php access
- SQL syntax errors in web server logs
Network Indicators:
- HTTP POST requests to backup.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/modules/system/backup.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "INSERT")