SOCA Access Control System 180612 SQL Injection and Authentication Bypass

Critical Vulnerability Information Vulnerability Title SOCA Access Control System 180612 SQL Injection And Authentication Bypass ID Advisory ID: ZSL-2019-5519 Type Type: Local/Remote Impact & Risk Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data Risk: 5/5 Release Date Release Date: 13.05.2019 Vulnerability Description The SOCA web access control system is affected by multiple SQL Injection vulnerabilities. Input passed via multiple POST parameters is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries and bypass the authentication mechanism. It allows the attacker to remotely disclose password hashes and log in using an MD5 hash with highest privileges, resulting in unlocking doors and bypassing the physical access control system in place. Vendor SOCA Technology Co., Ltd - http://www.socatech.com Affected Versions 180612 170000 141007 Test Environment Windows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586 Windows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586 Apache/2.2.22 (Win32) PHP/5.4.13 Vendor Status N/A Proof of Concept (PoC) soga_sqlinj.txt Discoverer Vulnerability discovered by Gjoko Krstic - References 1. 2. 3. 4. Update Log [13.05.2019] - Initial release [15.05.2019] - Added reference [4] Contact Zero Science Lab Web: http://www.zeroscience.mk e-mail: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

SOCA Access Control System 180612 SQL Injection and Authentication Bypass