Computrols CBAS-Web Boolean-Based Blind SQL Injection Vulnerability

A boolean-based blind SQL injection vulnerability has been identified in Computrols CBAS-Web version 19.0.0. This vulnerability exists in the 'id' parameter of the servers endpoint, allowing authenticated attackers to manipulate database queries. Exploitation of this vulnerability enables attackers to extract or infer database information by crafting specific SQL injection payloads.

Impact

Exploitation of this vulnerability allows for boolean-based blind SQL injection, where an attacker can manipulate SQL queries and potentially access or modify database information.

Reproduction

To reproduce this vulnerability, an authenticated user can send a request to the 'servers' endpoint with a crafted 'id' parameter that includes a boolean-based SQL injection payload. For example, an injection payload could be '1 AND 2510=2510', which would bypass certain query conditions and potentially expose database information.