{"uuid": "fc3abe48-6c8f-42c9-9a23-5ae1e27d7ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/0417c90c483638a47c269ca535dfae99", "content": "# CVE-2026-39191 \u2013 SQL Injection to RCE in StandVoice by Conviviance\n\n**Product**: StandVoice  \n**Vendor**: Conviviance  \n**Versions Affected**: 4.5 through 6.2  \n**Vulnerability Type**: SQL Injection / Code Injection (CWE-89, CWE-94)  \n**CVE ID**: CVE-2026-39191  \n**Related**: CVE-2024-42533 (same SQLi entry point, different exploitation technique and impact)  \n**Reporter**: 7h30th3r0n3 \u2013 OSINX  \n**CVSS v3.1 Base Score**: 10.0 (Critical)  \n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`\n\n---\n\n## Description\n\nA critical SQL Injection vulnerability in the authentication module of Conviviance StandVoice (versions 4.5 through 6.2) allows a remote, unauthenticated attacker to achieve arbitrary code execution. By injecting a `UNION SELECT \u2026 INTO OUTFILE` payload into the `Login` parameter (`GEST_LOGIN` field) of `Identification.php`, an attacker can write a PHP webshell directly to the web root. The webshell is then executed with **NT AUTHORITY\\SYSTEM** privileges, resulting in full system compromise.\n\nThis vulnerability is related to CVE-2024-42533 which covers the same SQL injection entry point but was limited to authentication bypass. CVE-2026-39191 demonstrates a different exploitation technique escalating from SQL injection to remote code execution.\n\n---\n\n## Technical Details\n\n**Injection Point:**\n- **Endpoint**: `POST /Identification.php?TYPE=Master`\n- **Parameter**: `Login` (`GEST_LOGIN` field)\n- **Authentication Required**: None\n\n**Exploitation Chain:**\n\n1. The `Login` parameter is passed unsanitized into a SQL query.\n2. Using a `UNION SELECT` statement combined with `INTO OUTFILE`, the attacker writes arbitrary PHP code to the web-accessible directory.\n3. The written PHP file acts as a webshell, accessible via a direct HTTP request.\n4. The webshell executes commands as **NT AUTHORITY\\SYSTEM** (the service account running the web server on Windows).\n\n**Impact Summary:**\n\n- **Remote Code Execution**: Arbitrary OS commands via webshell.\n- **Privilege Escalation**: Code runs as NT AUTHORITY\\SYSTEM.\n- **Full System Compromise**: Complete control over the affected server.\n\n---\n\n## Impact\n\n- **Code Execution**: Arbitrary command execution on the underlying operating system.\n- **Privilege Escalation**: Webshell runs with the highest Windows privilege level (SYSTEM).\n- **Data Exfiltration**: Full read access to all files and databases on the server.\n- **Lateral Movement**: Compromised server can be used as a pivot point for further attacks.\n\n---\n\n## Timeline\n\n>     June 14, 2024: Discovery of the original SQL injection vulnerability (CVE-2024-42533).\n>     June 17, 2024: Initial vulnerability report sent to Conviviance.\n>     June 25, 2024: Conviviance confirms patch available in latest version above 6.x.\n>     August 23, 2024: CVE-2024-42533 assigned.\n>     2026: Discovery of RCE exploitation technique on the same injection point.\n>     August 26, 2026: CVE-2026-39191 assigned by MITRE.\n\n_Disclosure timestamp: 2026-08-26_  \n_The SQL injection has been patched in versions above 6.x._\n\n---\n\n## References\n\n- [CVE-2024-42533 \u2013 Original SQL Injection Advisory](https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8)\n- [Conviviance](http://conviviance.com)\n- [StandVoice](http://standvoice.com)\n\n---\n\n## Discoverer / Credits\n\nReported by **7h30th3r0n3** \u2013 [OSINX](https://osinx.fr)\n", "creation_timestamp": "2026-08-26T08:09:19.724064Z"}