Convivance StandVoice SQL Injection Vulnerability in Authentication Module

A critical SQL injection vulnerability has been identified in the authentication module of Convivance StandVoice, affecting versions 4.5 through 6.2. This vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'GEST_LOGIN' parameter. Exploitation of this flaw can bypass authentication and provide access to privileged accounts, including the Master account.

Impact

Exploitation of this vulnerability leads to unauthorized access by bypassing authentication mechanisms, allows privilege escalation to the 'Master' account, and exposes plaintext credentials that can be recovered from the frontend. Additionally, it enables attackers to manipulate application data by inserting, modifying, or deleting information.

Reproduction

The vulnerability can be reproduced by sending a crafted payload through the 'GEST_LOGIN' parameter in the login field. The injection point is not properly sanitized, allowing SQL syntax to be executed. For example, injecting ' OR '1'='1'-- - bypasses authentication and accesses the Master account.

Remediation

Users are advised to update to the latest version of Convivance StandVoice, as the vulnerability has been patched in versions above 6.2.