i-doit SQL Injection

2014.02.17
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

############################################################ # # COMPASS SECURITY ADVISORY http://www.csnc.ch/ # ############################################################# # # CVE ID : CVE-2014-1597 # CSNC ID: CSNC-2014-003 # Product: i-doit # Vendor: synetics Gesellschaft fr Systemintegration mbH # Subject: SQL Injection # Risk: Very High # Effect: Remotely exploitable # Author: Stephan Rickauer (stephan.rickauer () csnc ch) # Date: February 17th 2014 # ############################################################# Introduction: ------------- Compass Security AG [3] discovered a security flaws in the i-doit CMDB web application [2], which allows injection of arbitrary SQL code as authenticated i-doit user. Vulnerable: ----------- i-doit Pro 1.2.4 and likely all prior versions including i-doit Open. Description: ------------ The i-doit web application is vulnerable to SQL injection in at least one place. Exploiting this vulnerability leads to an authenticated user being able to inject arbitrary SQL statements, e.g. to dump the entire database. The vulnerable resource is the 'objID' parameter: http://localhost/?objID=1745' AND (SELECT 8137 FROM(SELECT COUNT(*) ... Remediation: ------------ Upgrade to i-doit Pro 1.2.5. According to the vendor, the so called Open flavour will no longer receive patches in its current branch. Milestones: ----------- 2014-01-17 Vulnerability discovered, Vendor notified, CVE ID requested 2014-01-20 Acknowledgement of vulnerability by vendor and agreement of advisory release schedule. CVE ID assigned my MITRE. 2014-02-14 Release of patched vendor software version 1.2.5. 2014-02-17 Public release of this advisory. References: ----------- [1] http://www.i-doit.org [2] http://www.i-doit.com [3] http://www.csnc.ch


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top