PT-2018-9746 · Elo · Eloprofessional+1

Jens Regel · Publicado 2018-07-11 · Atualizado 2018-09-11 · CVE-2018-10197

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ELOenterprise versions 9.0.0 through 9.18.039 ELOenterprise versions 10.0.0 through 10.18.039 ELOprofessional versions 9.0.0 through 9.18.039 ELOprofessional versions 10.0.0 through 10.18.039

Description: The issue allows for time-based blind SQL injection, enabling the reading of all database content. This is made possible through the ticket HTTP GET parameter. For instance, it can be used to read the password hash of the administrator user in the userdata table from the eloam database.

Recommendations: For ELOenterprise versions 9.0.0 through 9.18.039, update to version 9.18.040 or later. For ELOenterprise versions 10.0.0 through 10.18.039, update to version 10.18.040 or later. For ELOprofessional versions 9.0.0 through 9.18.039, update to version 9.18.040 or later. For ELOprofessional versions 10.0.0 through 10.18.039, update to version 10.18.040 or later. As a temporary workaround, consider restricting access to the ticket HTTP GET parameter to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-10197

Produtos afetados

Eloenterprise

Eloprofessional

Referências · 3

• 🔥 http://seclists.org/fulldisclosure/2018/Jul/29 · Exploit
• https://osv.dev/vulnerability/CVE-2018-10197 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10197 · Nota de Segurança