CVE-2020-25147

Vulnerability

Observium Professional, Enterprise & Community version 20.8.10631 contains a SQL injection vulnerability in the authentication module. The issue resides in includes/authenticate.inc.php where the username parameter is not properly sanitized when passed as an array (e.g., username[0]). This allows an attacker to inject malicious SQL statements by sending a malformed parameter type, bypassing the core SQL injection sanitization. The vulnerability affects both the Community and Pro versions [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the default URI with the username parameter as an array containing malicious SQL. No authentication or special privileges are required. The attacker can inject arbitrary SQL queries, and the injection works even without the debug parameter. The proof of concept demonstrates that sending an array type bypasses the sanitization [1].

Impact

Successful exploitation leads to full database disclosure, including sensitive data such as user credentials and authentication keys (ckeys). An attacker can extract the entire database contents, potentially gaining unauthorized access to the system without knowing usernames or plaintext passwords. The impact is high, as it compromises confidentiality and integrity of the application's data [1].

Mitigation

As of the publication date (2020-09-25), no official patch has been released. Users are advised to monitor the Observium website for updates. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Until a fix is available, consider restricting network access to the Observium web interface or implementing a web application firewall (WAF) to block malicious SQL injection attempts [1].