PT-2015-7513 · K2+1 · K2 Blackpearl+3

Publicado 2015-10-21 · Atualizado 2021-03-31 · CVE-2015-7299

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions K2 blackpearl version 4.6.7 K2 smartforms version 4.6.7 K2 for SharePoint version 4.6.7

Description The issue allows remote attackers to execute arbitrary SQL commands via the xml parameter in the Runtime/Runtime/AjaxCall.ashx file. This can be exploited by sending malicious input to the affected endpoint.

Recommendations For K2 blackpearl version 4.6.7, consider restricting access to the Runtime/Runtime/AjaxCall.ashx file until a patch is available. For K2 smartforms version 4.6.7, avoid using the xml parameter in the affected API endpoint until the issue is resolved. For K2 for SharePoint version 4.6.7, as a temporary workaround, consider disabling the AjaxCall.ashx file to prevent exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-7299

Produtos afetados

K2 Blackpearl

K2 For Sharepoint

K2 Smartforms

Sharepoint Server

Referências · 4

• 🔥 http://packetstormsecurity.com/files/133953/K2-SmartForms-BlackPearl-SQL-Injection.html · Exploit
• http://securityfocus.com/archive/1/536673/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7299 · Nota de Segurança
• https://t.me/cvenotify/12397 · Publicação no Telegram