eDirectory SQL Injection Vulnerability Allowing Authentication Bypass and File Disclosure

A SQL injection vulnerability has been identified in eDirectory, affecting all versions. This vulnerability allows unauthenticated attackers to bypass administrator authentication and access sensitive files. The issue arises from improper neutralization of SQL code in parameters, which can be exploited to inject malicious SQL and manipulate database queries.

Impact

Exploitation of this vulnerability allows for authentication bypass, granting attackers administrative access, and the ability to disclose sensitive files from the server.

Reproduction

The vulnerability can be reproduced by injecting SQL code into the 'key' parameter of the login endpoint. This can be done using a union-based SQL injection to authenticate as an administrator. Once authenticated, the file disclosure vulnerability can be exploited by accessing 'language_file.php' and specifying a path to a PHP file on the server.