^{CVE-2021-32051:}SQL Injection vulnerability in Hexagon G!nius Auskunftsportal before version 5.0.0.0

Overview

The Hexagon G!nius Auskunftsportal (information portal) is a GIS-based utility management system used by organizations to manage infrastructure data. The vulnerability exists in the file download functionality where user-supplied input in the 'id' parameter is not properly sanitized before being used in SQL queries. This allows attackers to inject and execute arbitrary SQL commands within the application's database. The impact of this vulnerability can be severe as it may allow unauthorized access to sensitive information stored in the database, including user credentials, personal information, and infrastructure data. Additionally, depending on database permissions, attackers might be able to modify or delete data, or potentially gain further access to the underlying system.

Remediation

Organizations using Hexagon G!nius Auskunftsportal should implement the following remediation steps:

1. Update to version 5.0.0.0 or later as soon as possible, as this version addresses the SQL injection vulnerability.
2. If immediate updating is not possible, consider implementing additional security controls such as:
   • Deploying a web application firewall (WAF) configured to block SQL injection attempts
   • Restricting access to the vulnerable endpoint through network segmentation
   • Implementing input validation at the network perimeter
3. Monitor database logs for suspicious queries that might indicate exploitation attempts
4. Conduct a security assessment to identify any signs of previous exploitation
5. Follow the principle of least privilege for database accounts used by the application

References

1. Packet Storm Security - Hexagon G-nius Auskunftsportal SQL Injection: http://packetstormsecurity.com/files/162534/Hexagon-G-nius-Auskunftsportal-SQL-Injection.html

2. GitHub - Exploit details and proof of concept: https://gist.githubusercontent.com/mke1985/a21a71098f48829916dfec74eff1e24a/raw/f635b060ad03e23fd887de48a79b70040daadadb/CVE-2021-32051

3. Hexagon Product Information: https://www.hexagonsafetyinfrastructure.com/products/utilities-and-communications-products/advanced-utility-gis/hexagon-ginius

4. Common Weakness Enumeration - CWE-89 (SQL Injection): https://cwe.mitre.org/data/definitions/89.html