full-disclosure - DDIVRT-2012-43 SCLIntra Enterprise SQL Injection and Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <C2AE6D03-DE60-4068-AB12-7B8F4E5646FB@ddifrontline.com>
Date: Tue, 29 May 2012 10:13:18 -0500
From: ddivulnalert <ddivulnalert@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-2012-43 SCLIntra Enterprise SQL Injection
	and Authentication Bypass

Title
-----
DDIVRT-2012-43 SCLIntra Enterprise SQL Injection and Authentication Bypass

Severity
--------
High

Date Discovered
---------------
April 2, 2012

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: r@...$

Vulnerability Description
-------------------------
Multiple SQL injection vectors and an authentication bypass were discovered in SCLIntra Enterprise. An attacker can leverage this flaw to bypass authentication to the application or to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques.

Solution Description
--------------------
The vendor has indicated that the current version of SCLIntra Enterprise is version 6 and does not contain the vulnerabilities reported by DDI. Any SCLIntra Enterprise customers still using versions prior to 6 should contact SCLogic at 1.888.700.7027 to remedy the vulnerabilities (a current SCLogic support contract is required).

Tested Systems / Software
-------------------------
SCLogic SCLIntra Enterprise 5.5.2 on Windows 2003

Vendor Contact
--------------
Vendor Name: SCLogic
Vendor Website: http://www.sclogic.com/
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/