PT-2018-2162 · Galakтиka · Galakтиka Erp

Publicado 2018-08-31 · Atualizado 2018-08-31

Positive Technologies (AI Summary)

CVSS v2.0

7.7

Alta

Vetor base

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Galakтиka ERP (affected versions not specified)

Description The issue is related to insufficient access control in the GalSrv directory used in the system's two-tier architecture. An attacker with USERS group privileges can exploit this by placing malicious dll libraries, such as winmm.dll, in the GalSrv directory. These libraries will be loaded instead of the system ones when administrative utilities or user applications are launched, potentially allowing the execution of arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-00115

Produtos afetados

Galakтиka Erp

Referências · 1

• https://bdu.fstec.ru/vul/2019-00115 · Nota de Segurança