##=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+##
||                                                                  ||
|| Advisory           : Kwok Information Server Blind Sql Injection ||
|| Affected Version   : 2.7.3 & 2.8.4                               ||
|| Vendor             : http://www.kwoksys.com/index.php            ||
|| Risk               : Medium                                      ||
|| CVE-ID             : 2013-5028                                   ||
|| Tested on Platform : Windows 7                                   ||
##=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+##
 
============
 
Product Description:
 
Kwok Information Server is an open source IT management system, providing a single application for managing IT assets, software licenses, contracts, issues, contacts. Additional modules include portal, RSS, blogging. (from product home page)
 
============
 
Vulnerability Description:
 
A Blind SQL Injection vulnerability has been detected in Kwok Information Server. Application failed to sanitize user supplied input in parameters "hardwareType", "hardwareStatus" and "hardwareLocation" of page hardware-index.
 
User must be authenticated to exploit this vulnerability.
 
This vulnerability was tested with Kwok Information Server 2.7.3 and 2.8.4. Other versions may also be affected.
 
=============
 
Impact:
 
Successful exploitation of this vulnerability will allow a remote authenticated attacker to extract
sensitive and confidential data from the database.
 
=============
 
Proof of Concept:
 
1]
Url: http://10.10.75.59:8080/kwok/IT/hardware-list.dll?cmd=search&hardwareType=49[Inject Payload Here]
 
2]
Url: http://10.10.75.59:8080/kwok/IT/hardware-list.dll?cmd=search&hardwareStatus=0[Inject Payload Here]
 
3]
Url: http://10.10.75.59:8080/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here]
 
 
=============
 
Solution:
 
This vulnerability has been fixed in version 2.8.5 of Kwok Information Server.
 
=============
 
Disclosure Timeline:
~Vendor notification: 31st July
~Vendor response: 31st July
~Vendor released updates: 7th August
~Public disclosure: 12th September
===========================================================================================================
 
Advisory discovered by: Yogesh Phadtare 
                        Secur-I Research Group
                        http://securview.com/