PT-2017-16399 · Sage · Sagecrm

Publicado 2017-02-02 · Atualizado 2017-03-02 · CVE-2017-5218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SageCRM versions 7.x through 7.3 SP2

Description A SQL Injection issue was discovered. The AP DocumentUI.asp web resource includes Utilityfuncs.js, which crafts a SQL statement to identify the database in use with the current user's session. The database variable can be populated from the URL and manipulated to obtain access to the underlying database using non-expected characters. A Proof of Concept URI is /CRM/CustomPages/ACCPAC/AP DocumentUI.asp?SID=&database=1';WAITFOR DELAY '0:0:5'--

Recommendations For SageCRM versions 7.x through 7.3 SP2, update to version 7.3 SP3 or later to resolve the issue. As a temporary workaround, consider restricting access to the AP DocumentUI.asp web resource and the Utilityfuncs.js file to minimize the risk of exploitation. Avoid using the database variable in the affected API endpoint until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-5218

Produtos afetados

Sagecrm

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-5218 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5218 · Nota de Segurança
• http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218 · Nota
• http://securityfocus.com/bid/95968 · Nota