bugtraq - SAP's web module OLK SQL Injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201006291844.o5TIiSMv026936@www3.securityfocus.com>
Date: Tue, 29 Jun 2010 12:44:28 -0600
From: salchoman@...il.com
To: bugtraq@...urityfocus.com
Subject: SAP's web module OLK SQL Injection vulnerability

#################################################
###### SAP's web module OLK: SQL Injection ######
#################################################

$ Author: salcho - salchoman@...il.com
$ Home  : CSL Labs
$ Date  : 27/06/2010

$#########################################################

[+] Vendor  : http://www.topmanage.com.pa/

[+] Product : http://www.topmanage.com.pa/products/1/

[+] Version : 1.91.30 [Prior versions might be vulnerable too.]

[+] Dork    : inurl: /olk/c_p

$#######################DISCLAIMER########################
The author does not take any responsibility for the use this 
information might be put to. All the information provided
here is for educational purposes only. The authir is no way 
responsible for any misuse of the information.

$#####################SQL INJECTION#######################

[+] Affected: /olk/c_p/searchCart.asp

[+] Description : The forms Price From, Price To, Inventory
	      greater than, and some others in the "Advanced
	      Search" are vulnerable to SQL Injection allowing
	      an attacker to review or execute commands in the
	      local Database (according to the web server's 
	      configuration)

[+] PoC :     It's posible to check if the app is vulnerable
	      by trying something like: 100000000 or 1=2 on
	      the "Price From" form, as the second part of the
	      injection is never true, the app won't show any
	      results; although if the injection is crafted as
	      100000000 or 1=1, the app will show every product
	      on its database.