KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass
Title: KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass
Advisory ID: ZSL-2021-5655
Type: Local/Remote
Impact: System Access, Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data, Security Bypass
Risk: (5/5)
Release Date: 20.07.2021
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68
[08.07.2021] Vendor contacted.
[12.07.2021] No response from the vendor.
[13.07.2021] Vendor contacted.
[19.07.2021] No response from the vendor.
[20.07.2021] Public security advisory released.
[2] https://www.exploit-db.com/exploits/50146
[3] https://cxsecurity.com/issue/WLB-2021070122
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/205980
[5] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37291
[21.07.2021] - Added reference [1], [2] and [3]
[22.07.2021] - Added reference [4]
[11.04.2022] - Added reference [5]
Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2021-5655
Type: Local/Remote
Impact: System Access, Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data, Security Bypass
Risk: (5/5)
Release Date: 20.07.2021
Summary
KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of energy usage and facilities in the building. It also manages energy usage, facility efficiency and indoor environment control.Description
The application suffers from an unauthenticated SQL Injection vulnerability. Input passed through 'input_id' POST parameter in '/http/index.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication mechanism.Vendor
KevinLAB Inc. - http://www.kevinlab.comAffected Version
4ST L-BEMS 1.0.0 (Building Energy Management System)Tested On
Linux CentOS 7Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68
Vendor Status
[05.07.2021] Vulnerability discovered.[08.07.2021] Vendor contacted.
[12.07.2021] No response from the vendor.
[13.07.2021] Vendor contacted.
[19.07.2021] No response from the vendor.
[20.07.2021] Public security advisory released.
PoC
kevinlab_bems_sqli.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://packetstormsecurity.com/files/163572/[2] https://www.exploit-db.com/exploits/50146
[3] https://cxsecurity.com/issue/WLB-2021070122
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/205980
[5] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37291
Changelog
[20.07.2021] - Initial release[21.07.2021] - Added reference [1], [2] and [3]
[22.07.2021] - Added reference [4]
[11.04.2022] - Added reference [5]
Contact
Zero Science LabWeb: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
