CVE-2023-6145
📋 TL;DR
This SQL injection vulnerability in Softomi Advanced C2C Marketplace Software allows attackers to execute arbitrary SQL commands against the database. It affects all versions before December 12, 2023, potentially compromising sensitive data and system integrity.
💻 Affected Systems
- Softomi Advanced C2C Marketplace Software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive user data (personal information, payment details), manipulation of marketplace listings, and privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error-based information disclosure.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity; unauthenticated exploitation suggests vulnerable endpoints don't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version dated 12122023 or later
Vendor Advisory: https://www.usom.gov.tr/bildirim/tr-23-0724
Restart Required: Yes
Instructions:
1. Contact Istanbul Soft Informatics for updated version. 2. Backup database and application. 3. Install version dated December 12, 2023 or later. 4. Restart application services. 5. Verify functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Input Validation Filter
allImplement application-level input validation to sanitize user inputs
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input validation
- Implement database-level controls: minimal privileges, stored procedures, and query parameterization
🔍 How to Verify
Check if Vulnerable:
Check application version in admin panel or configuration files; if version date is before December 12, 2023, it's vulnerable.Check Version:
Check application admin interface or configuration files for version informationVerify Fix Applied:
Confirm version is 12122023 or later and test SQL injection payloads against application endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns
- SQL syntax errors in application logs
- Multiple failed login attempts with SQL payloads
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, INSERT, etc.)
- Unusual database port traffic from web servers
SIEM Query:
source="web_logs" AND ("SELECT" OR "UNION" OR "INSERT" OR "DELETE") AND status=200