CVE-2023-50073
📋 TL;DR
EmpireCMS v7.5 contains a SQL injection vulnerability in the ftppassword parameter at SetEnews.php. This allows attackers to execute arbitrary SQL commands on the database. All EmpireCMS v7.5 installations using default configurations are affected.
💻 Affected Systems
- EmpireCMS
📦 What is this software?
Empirecms by Leadscloud
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation within the CMS.
If Mitigated
Limited impact with proper input validation and database permissions restricting query execution.
🎯 Exploit Status
Exploitation requires authentication to access SetEnews.php. The SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.5 with security patch applied
Vendor Advisory: https://github.com/leadscloud/EmpireCMS/issues/7
Restart Required: No
Instructions:
1. Download the latest EmpireCMS version or security patch. 2. Replace the vulnerable SetEnews.php file. 3. Verify the fix by testing the ftppassword parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter SQL special characters from ftppassword parameter
Modify SetEnews.php to sanitize ftppassword input using prepared statements or parameterized queries
Access Restriction
allRestrict access to SetEnews.php to trusted IP addresses only
Add .htaccess rules or web server configuration to limit access to SetEnews.php
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting ftppassword parameter
- Restrict database user permissions to minimum required operations
🔍 How to Verify
Check if Vulnerable:
Test ftppassword parameter in SetEnews.php with SQL injection payloads like ' OR '1'='1Check Version:
Check EmpireCMS version in admin panel or readme filesVerify Fix Applied:
Test the same SQL injection payloads after patching to confirm they no longer work📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SetEnews.php access
- SQL error messages in web server logs
Network Indicators:
- POST requests to SetEnews.php with SQL injection patterns in parameters
SIEM Query:
source="web_server" AND uri="/SetEnews.php" AND (param="ftppassword" AND value MATCHES "[';]|OR|UNION|SELECT")