PT-2018-1291 · Ericsson Lg · Ericsson-Lg Ipecs Nms

Berk Cem Göksel · Publicado 2018-03-03 · Atualizado 2018-05-25 · CVE-2018-9245

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ericsson-LG iPECS NMS (affected versions not specified)

Description The issue is related to a lack of protection for the SQL query structure, allowing for SQL injection. This can be exploited by a remote attacker to bypass the authentication procedure and execute arbitrary code using the id and passwd parameters by sending HTTP POST requests. The vulnerability enables attackers to bypass the login page and execute remote code on the operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2018-00787

CVE-2018-9245

Produtos afetados

Ericsson-Lg Ipecs Nms

Referências · 5

• 🔥 https://exploit-db.com/exploits/44515 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9245 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00787 · Nota de Segurança
• https://gist.github.com/berkgoksel/99ba5c1f3f9f6e4e33e7ad966c007693 · Nota
• https://osv.dev/vulnerability/CVE-2018-9245 · Aviso do Fabricante