PT-2018-4439 · Rxtec · Radmin

Thomas Konrad · Publicado 2018-09-24 · Atualizado 2018-11-13 · CVE-2015-8298

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RXTEC RXAdmin UPDATE 06 / 2012

Description The issue concerns SQL injection vulnerabilities in the login page. Remote attackers can execute arbitrary SQL commands by manipulating specific parameters to the index.htm page, including the loginpassword, loginusername, zusatzlicher, and groupid parameters, or by altering the rxtec cookie.

Recommendations For RXTEC RXAdmin UPDATE 06 / 2012, consider restricting access to the login page until a fix is available, and avoid using the vulnerable parameters loginpassword, loginusername, zusatzlicher, and groupid in the index.htm page, as well as the rxtec cookie.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-8298

Produtos afetados

Radmin

Referências · 4

• 🔥 http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html · Exploit
• https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513 · Nota
• http://seclists.org/fulldisclosure/2015/Nov/90 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8298 · Nota de Segurança