CVE-2021-47704
📋 TL;DR
OpenBMCS 2.4 contains an SQL injection vulnerability in the /debug/obix_test.php endpoint that allows authenticated attackers to execute arbitrary SQL commands. This enables attackers to read, modify, or delete database contents. Organizations running OpenBMCS 2.4 with the debug endpoint accessible are affected.
💻 Affected Systems
- OpenBMCS
📦 What is this software?
Openbmcs by Openbmcs
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data manipulation, privilege escalation, and potential system takeover via subsequent attacks.
Likely Case
Unauthorized access to sensitive database information, potential data leakage, and integrity violations.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and restricted debug endpoint access.
🎯 Exploit Status
Exploit requires authentication but is trivial to execute via crafted GET requests with malicious 'id' parameters
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.openbmcs.com
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. Apply any available patches
3. Verify fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Disable Debug Endpoint
linuxRemove or restrict access to the vulnerable /debug/obix_test.php file
mv /path/to/openbmcs/debug/obix_test.php /path/to/openbmcs/debug/obix_test.php.disabled
chmod 000 /path/to/openbmcs/debug/obix_test.php
Implement Input Validation
allAdd proper input sanitization and parameterized queries to the vulnerable script
🧯 If You Can't Patch
- Implement strict network access controls to restrict access to the debug endpoint
- Deploy a web application firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Test if /debug/obix_test.php is accessible and responds to SQL injection attempts with crafted 'id' parametersCheck Version:
Check OpenBMCS documentation or configuration files for version informationVerify Fix Applied:
Confirm the endpoint is no longer accessible or properly sanitizes input📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /debug/obix_test.php with suspicious parameters
- Database error messages containing SQL syntax
Network Indicators:
- HTTP GET requests to /debug/obix_test.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri_path="/debug/obix_test.php" AND (param_id CONTAINS "UNION" OR param_id CONTAINS "SELECT" OR param_id CONTAINS "--")