############################################################ # # COMPASS SECURITY ADVISORY http://www.csnc.ch/ # ############################################################# # # CVE ID : CVE-2014-1597 # CSNC ID: CSNC-2014-003 # Product: i-doit # Vendor: synetics Gesellschaft fr Systemintegration mbH # Subject: SQL Injection # Risk: Very High # Effect: Remotely exploitable # Author: Stephan Rickauer (stephan.rickauer () csnc ch) # Date: February 17th 2014 # ############################################################# Introduction: ------------- Compass Security AG [3] discovered a security flaws in the i-doit CMDB web application [2], which allows injection of arbitrary SQL code as authenticated i-doit user. Vulnerable: ----------- i-doit Pro 1.2.4 and likely all prior versions including i-doit Open. Description: ------------ The i-doit web application is vulnerable to SQL injection in at least one place. Exploiting this vulnerability leads to an authenticated user being able to inject arbitrary SQL statements, e.g. to dump the entire database. The vulnerable resource is the 'objID' parameter: http://localhost/?objID=1745' AND (SELECT 8137 FROM(SELECT COUNT(*) ... Remediation: ------------ Upgrade to i-doit Pro 1.2.5. According to the vendor, the so called Open flavour will no longer receive patches in its current branch. Milestones: ----------- 2014-01-17 Vulnerability discovered, Vendor notified, CVE ID requested 2014-01-20 Acknowledgement of vulnerability by vendor and agreement of advisory release schedule. CVE ID assigned my MITRE. 2014-02-14 Release of patched vendor software version 1.2.5. 2014-02-17 Public release of this advisory. References: ----------- [1] http://www.i-doit.org [2] http://www.i-doit.com [3] http://www.csnc.ch