full-disclosure - SQL Injection i-doit Pro (CVE-2014-1597)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 17 Feb 2014 09:29:38 +0100
From: Stephan Rickauer <stephan.rickauer@...c.ch>
To: full-disclosure@...ts.grok.org.uk, vuln@...unia.com
Subject: SQL Injection i-doit Pro (CVE-2014-1597)

#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2014-1597
# CSNC ID: CSNC-2014-003
# Product: i-doit
# Vendor:  synetics Gesellschaft für Systemintegration mbH
# Subject: SQL Injection
# Risk:    Very High
# Effect:  Remotely exploitable
# Author:  Stephan Rickauer (stephan.rickauer@...c.ch)
# Date:    February 17th 2014
#
#############################################################


Introduction:
-------------
Compass Security AG [3] discovered a security flaws in the i-doit CMDB
web application [2], which allows injection of arbitrary SQL code as
authenticated i-doit user.


Vulnerable:
-----------
i-doit Pro 1.2.4 and likely all prior versions including i-doit Open.


Description:
------------
The i-doit web application is vulnerable to SQL injection in at least 
one place. Exploiting this vulnerability leads to an authenticated user 
being able to inject arbitrary SQL statements, e.g. to dump the entire 
database.

The vulnerable resource is the 'objID' parameter:
http://localhost/?objID=1745' AND (SELECT 8137 FROM(SELECT COUNT(*) ...


Remediation:
------------
Upgrade to i-doit Pro 1.2.5. According to the vendor, the so called Open
flavour will no longer receive patches in its current branch.


Milestones:
-----------
2014-01-17  Vulnerability discovered, Vendor notified, CVE ID requested
2014-01-20  Acknowledgement of vulnerability by vendor and agreement of
             advisory release schedule. CVE ID assigned my MITRE.
2014-02-14  Release of patched vendor software version 1.2.5.
2014-02-17  Public release of this advisory.


References:
-----------
[1] http://www.i-doit.org
[2] http://www.i-doit.com
[3] http://www.csnc.ch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/