PT-2017-9622 · Ecava · Ecava Integraxor

Brian Gorenc + 1 · Publicado 2017-02-07 · Atualizado 2017-03-01 · CVE-2016-8341

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor version 5.0.413.0

Description The issue concerns SQL injection vulnerability in the Ecava IntegraXor web server. Specifically, parameters are not properly sanitized, which could allow an attacker to execute read, write, and delete commands on the host's database. The getdata parameter is mentioned as being vulnerable to SQL injection, potentially leading to remote code execution.

Recommendations For Ecava IntegraXor version 5.0.413.0, consider restricting access to the getdata parameter in the web server to minimize the risk of exploitation until a patch is available. As a temporary workaround, ensure that all queries are properly sanitized to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-8341

ZDI-17-058

ZDI-17-059

Produtos afetados

Ecava Integraxor

Referências · 6

• https://zerodayinitiative.com/advisories/ZDI-17-059 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-17-058 · Nota de Segurança
• http://securityfocus.com/bid/95907 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8341 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-17-031-02 · Nota
• https://osv.dev/vulnerability/CVE-2016-8341 · Aviso do Fabricante