CVE-2023-36361
📋 TL;DR
Audimexee v14.1.7 contains a SQL injection vulnerability in the p_table_name parameter that allows attackers to execute arbitrary SQL commands. This affects all systems running the vulnerable version of Audimexee software. Successful exploitation could lead to data theft, data manipulation, or complete system compromise.
💻 Affected Systems
- Audimexee
📦 What is this software?
Audimexee by Web Audimex
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, data destruction, privilege escalation to database administrator, and potential remote code execution on the underlying server.
Likely Case
Unauthorized data access and extraction, including sensitive business information, user credentials, and configuration data.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and public proof-of-concept code exists in the referenced GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://audimex.com
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply. 3. Test functionality after patching. 4. Monitor for any issues.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation to reject malicious SQL characters in p_table_name parameter
Implement regex filter: ^[a-zA-Z0-9_]+$ for table names
Web Application Firewall
allDeploy WAF with SQL injection protection rules
Configure WAF to block SQL injection patterns in request parameters
🧯 If You Can't Patch
- Isolate the vulnerable system from internet access and restrict internal network access
- Implement database user privilege restrictions to limit potential damage from exploitation
🔍 How to Verify
Check if Vulnerable:
Test p_table_name parameter with SQL injection payloads like ' OR '1'='1 and monitor for unexpected database responsesCheck Version:
Check application version in admin interface or configuration filesVerify Fix Applied:
Retest with SQL injection payloads after implementing fixes and confirm proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- Unusual database queries
- SQL syntax errors in application logs
- Multiple failed login attempts from single IP
Network Indicators:
- Unusual SQL patterns in HTTP requests
- Requests with SQL keywords in parameters
SIEM Query:
source="web_logs" AND (p_table_name CONTAINS "UNION" OR p_table_name CONTAINS "SELECT" OR p_table_name CONTAINS "OR 1=1")🔗 References
- http://audimex.com
- http://audimexee.com
- https://gist.github.com/Cameleon037/40b3b6f6729d1d0984d6ce5b6837c46b
- https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2023-36361
- http://audimex.com
- http://audimexee.com
- https://gist.github.com/Cameleon037/40b3b6f6729d1d0984d6ce5b6837c46b
- https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2023-36361
