PT-2018-13678 · Rausoft+1 · Rausoft Id.Prove+1

Ilya Timchenko · Publicado 2018-09-28 · Atualizado 2019-11-05 · CVE-2018-16659

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rausoft ID.prove version 2.95

Description An issue was discovered that allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter on the login page. This could potentially be used for privilege elevation, for example, by utilizing master..xp cmdshell.

Recommendations For Rausoft ID.prove version 2.95, consider restricting access to the login page or validating and sanitizing the Username parameter to prevent SQL injection attacks. As a temporary workaround, consider disabling the login functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-16659

Produtos afetados

Sql Server

Rausoft Id.Prove

Referências · 3

• 🔥 https://exploit-db.com/exploits/45500 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16659 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16659 · Aviso do Fabricante