Vulnerability CVE-2018-9245
Published: 2018-04-22

Description:
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page and execute remote code on the operating system.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Ericsson-LG iPECS NMS A.1Ac Credential Disclosure
Berk Cem Goksel
25.04.2018

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Ericssonlg -> Ipecs nms 

 References:
https://gist.github.com/berkgoksel/99ba5c1f3f9f6e4e33e7ad966c007693
https://www.exploit-db.com/exploits/44515/
Copyright 2024, cxsecurity.com

 

Back to Top