PT-2016-3154 · United Security Providers · U.Motion Builder

Publicado

2016-03-29

·

Atualizado

2017-09-27

·

CVE-2017-7973

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions U.motion Builder versions 1.2.1 and prior
Description The issue is caused by inadequate protection measures for the SQL query structure in the U.motion Builder software. This allows a remote attacker to exploit the vulnerability and execute arbitrary SQL commands against the underlying database. An unauthenticated user can use calls to various paths to perform these actions.
Recommendations For versions 1.2.1 and prior, consider restricting access to the SQL query structure until a patch is available. As a temporary workaround, avoid using the vulnerable SQL query functionality in the U.motion Builder software until the issue is resolved. Restrict access to the underlying database to minimize the risk of exploitation.

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2017-01820
CVE-2017-7973

Produtos afetados

U.Motion Builder