CVE-2021-43329

Vulnerability

A SQL injection vulnerability exists in license_update.php in Mumara Classic through version 2.93 [1][2][3]. The license POST parameter is not sanitized before being used in SQL queries, allowing an unauthenticated remote attacker to inject arbitrary SQL commands.

Exploitation

An attacker can exploit this vulnerability by sending a crafted POST request to license_update.php with a malicious license parameter. No authentication is required. The vulnerability is error-based blind SQL injection, which can be exploited manually or using automated tools such as sqlmap [2][3]. A sample sqlmap command is: sqlmap -u https://target/license_update.php --method POST --data "license=MUMARA-Delux-01x84ndsa40&install=install" -p license --cookie="PHPSESSID=any32gbaer3jaeif108fjci9x" --dbms=mysql [2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands on the underlying MySQL database. This can lead to unauthorized access to sensitive data, modification of database contents, or potential further compromise of the server.

Mitigation

The vendor has patched the vulnerability in legitimate future versions of Mumara Classic [1]. Users should upgrade to the latest patched version. As of the publication date (2022-08-25), no specific fixed version number has been disclosed. There is no known workaround; upgrading is the recommended action.