ImpressCMS 1.4.2 SQL Injection

`---------------------------------------------------------------  
ImpressCMS <= 1.4.3 (findusers.php) SQL Injection Vulnerability  
---------------------------------------------------------------  
  
  
[-] Software Link:  
  
https://www.impresscms.org  
  
  
[-] Affected Versions:  
  
Version 1.4.3 and prior versions.  
  
  
[-] Vulnerability Description:  
  
The vulnerability is located in the /include/findusers.php script:  
  
281. $total =   
$user_handler->getUserCountByGroupLink(@$_POST["groups"], $criteria);  
282.  
283. $validsort = array("uname", "email", "last_login",   
"user_regdate", "posts");  
284. $sort = (!in_array($_POST['user_sort'], $validsort)) ?   
"uname" : $_POST['user_sort'];  
285. $order = "ASC";  
286. if (isset($_POST['user_order']) && $_POST['user_order']   
== "DESC") {  
287. $order = "DESC";  
288. }  
289.  
290. $criteria->setSort($sort);  
291. $criteria->setOrder($order);  
292. $criteria->setLimit($limit);  
293. $criteria->setStart($start);  
294. $foundusers =   
$user_handler->getUsersByGroupLink(@$_POST["groups"], $criteria, TRUE);  
  
User input passed through the "groups" POST parameter is not properly   
sanitized before being passed to the   
icms_member_Handler::getUserCountByGroupLink() and   
icms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294.   
These methods use the first argument to construct a SQL query without   
proper validation, and this can be exploited by remote attackers to e.g.   
read sensitive data from the "users" database table through   
boolean-based SQL Injection attacks. The application allows for stacked   
SQL queries, as such this vulnerability could be exploited to e.g.   
create a new admin user and execute arbitrary PHP code.  
  
  
[-] Solution:  
  
Upgrade to version 1.4.4 or later.  
  
  
[-] Disclosure Timeline:  
  
[19/01/2021] - Vendor notified through HackerOne  
[29/01/2021] - Vulnerability acknowledged by the vendor  
[03/02/2021] - CVE number assigned  
[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed  
[11/02/2022] - Vendor was informed about the ineffective fix  
[09/03/2022] - Version 1.4.4 released  
[22/03/2022] - Public disclosure  
  
  
[-] CVE Reference:  
  
The Common Vulnerabilities and Exposures project (cve.mitre.org)  
has assigned the name CVE-2021-26599 to this vulnerability.  
  
  
[-] Credits:  
  
Vulnerability discovered by Egidio Romano.  
  
  
[-] Other References:  
  
https://hackerone.com/reports/1081145  
  
  
[-] Original Advisory:  
  
http://karmainsecurity.com/KIS-2022-04  
  
  
`