PT-2014-4472 · Innovative · Vtls-Virtua

José Tozo · Publicado 2014-10-20 · Atualizado 2015-01-26 · CVE-2014-2081

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Innovative vtls-Virtua versions prior to 2013.2.4 Innovative vtls-Virtua versions 2014.x prior to 2014.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username or password parameter in the login functionality of the web reports/cgi-bin/InfoStation.cgi endpoint.

Recommendations For versions prior to 2013.2.4, update to version 2013.2.4 or later. For versions 2014.x prior to 2014.1.1, update to version 2014.1.1 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-2081

Produtos afetados

Vtls-Virtua

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2014/Aug/64 · Exploit
• 🔥 https://exploit-db.com/exploits/34420 · Exploit
• 🔥 http://packetstormsecurity.com/files/127997/VTLS-Virtua-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2081 · Nota de Segurança