CVE-2023-33367
📋 TL;DR
This SQL injection vulnerability in Control ID IDSecure allows unauthenticated attackers to write PHP files to the server's root directory, leading to remote code execution. It affects IDSecure versions 4.7.26.0 and earlier, putting access control systems at risk of complete compromise.
💻 Affected Systems
- Control ID IDSecure
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining full administrative control, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Remote code execution leading to system compromise, credential theft, and potential ransomware deployment on affected access control systems.
If Mitigated
Limited impact with proper network segmentation, WAF protection, and restricted database permissions preventing successful exploitation.
🎯 Exploit Status
SQL injection to PHP file write chain makes exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.27.0 or later
Vendor Advisory: https://www.controlid.com.br/en/access-control/idsecure/
Restart Required: Yes
Instructions:
1. Download latest version from Control ID website. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart IDSecure service. 5. Verify version shows 4.7.27.0 or higher.
🔧 Temporary Workarounds
Network Segmentation
allIsolate IDSecure systems from internet and restrict internal network access
WAF Rules
allImplement web application firewall rules to block SQL injection patterns
# Example ModSecurity rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to IDSecure systems
- Deploy web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check IDSecure version in web interface or installation directory. Versions 4.7.26.0 or earlier are vulnerable.Check Version:
Check web interface at /admin or examine installation directory for version filesVerify Fix Applied:
Verify version shows 4.7.27.0 or higher in system information. Test SQL injection attempts should be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- PHP file creation in web root directory
- Unauthenticated access attempts to admin endpoints
Network Indicators:
- SQL injection patterns in HTTP requests
- POST requests with SQL syntax to vulnerable endpoints
- Unexpected PHP file uploads
SIEM Query:
source="web_logs" AND (uri="*idsecure*" OR uri="*admin*") AND (message="*sql*" OR message="*union*" OR message="*select*" OR message="*insert*")