PT-2010-4208 · Sap · Topmanage Olk

Publicado 2010-07-09 · Atualizado 2018-10-10 · CVE-2010-2686

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TopManage OLK module version 1.91.30 for SAP

Description The issue allows remote attackers to execute arbitrary SQL commands via vulnerable parameters in the clientes.asp file. Specifically, the PriceFrom, PriceTo, and InvFrom parameters are affected, as reachable from the "olk/c p/searchCart.asp" endpoint and other unspecified vectors when performing an advanced search.

Recommendations For TopManage OLK module version 1.91.30, avoid using the PriceFrom, PriceTo, and InvFrom parameters in the affected API endpoint until the issue is resolved. Restrict access to the clientes.asp file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-2686

Produtos afetados

Topmanage Olk

Referências · 5

• http://securityfocus.com/bid/41208 · Nota
• http://securityfocus.com/archive/1/512135 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2686 · Nota de Segurança
• http://secunia.com/advisories/40424 · Aviso do Fabricante
• http://securityfocus.com/archive/1/512084/100/0/threaded · Nota