PT-2018-14663 · Bsen · Bsen Ordering

Ihsan Sencan · Publicado 2018-11-16 · Atualizado 2018-12-18 · CVE-2018-18801

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BSEN Ordering software version 1.0

Description The issue concerns SQL Injection. It can be exploited via the index.php endpoint, specifically through the id parameter in the URLs student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=[SQL]. The id parameter is vulnerable, allowing potential SQL injection attacks.

Recommendations For BSEN Ordering software version 1.0, consider restricting access to the index.php endpoint, specifically the id parameter, to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-18801

Produtos afetados

Bsen Ordering

Referências · 4

• 🔥 https://exploit-db.com/exploits/45730 · Exploit
• 🔥 http://packetstormsecurity.com/files/150017/E-Negosyo-System-1.0-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-18801 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18801 · Nota de Segurança