Vulnerability CVE-2018-9245


Published: 2018-04-22

Description:
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page and execute remote code on the operating system.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Ericsson-LG iPECS NMS A.1Ac Credential Disclosure
Berk Cem Goksel
25.04.2018

Type:

CWE-89

(Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

Vendor: Ericssonlg
Product: Ipecs nms 
Version: a.1ac;

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
https://gist.github.com/berkgoksel/99ba5c1f3f9f6e4e33e7ad966c007693
https://www.exploit-db.com/exploits/44515/

Copyright 2018, cxsecurity.com

 

Back to Top