PT-2017-14970 · Zuuse · Zuuse Beims Contractorweb

Rajwinder Singh · Publicado 2017-12-18 · Atualizado 2019-03-21 · CVE-2017-17721

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0

Description The issue allows SQL injection via certain parameters. The vulnerable parameters include tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus.

Recommendations For ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0, consider restricting access to the affected parameters to minimize the risk of exploitation. Avoid using the parameters tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-17721

Produtos afetados

Zuuse Beims Contractorweb

Referências · 8

• 🔥 https://exploit-db.com/exploits/43379 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17721 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17721 · Aviso do Fabricante
• https://cxsecurity.com/issue/WLB-2017120155 · Nota
• https://packetstormsecurity.com/files/145511/BEIMS-ContractorWeb-5.18.0.0-SQL-Injection.html · Nota
• https://becomepentester.blogspot.com/2017/12/ZUUSE-BEIMS-ContractorWeb-SQLInjection-CVE-2017-17721.html · Nota
• https://cyber-security.ro/blog/2017/12/20/beims-contractorweb-5-18-0-0-sql-injection · Nota
• https://0day.today/exploit/29277 · Nota