PT-2019-11271 · Opt/Net Bv · Optoss Next Gen Network Management System

Publicado 2019-02-04 · Atualizado 2019-02-06 · CVE-2019-1000023

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) versions v3.6-2 and earlier

Description: The issue allows a malicious attacker to include their own SQL commands, which the database will execute, due to a SQL Injection vulnerability. The vulnerability is exploitable via network connectivity and is identified in the parameters: id, id access type, and id attr access.

Recommendations: For OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) versions v3.6-2 and earlier, consider restricting access to the vulnerable parameters id, id access type, and id attr access to minimize the risk of exploitation. Avoid using these parameters in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-1000023

Produtos afetados

Optoss Next Gen Network Management System

Referências · 6

• 🔥 https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-(NG-NetMS).html · Exploit
• https://owasp.org/index.php/SQL_Injection · Nota
• https://sourceforge.net/projects/ngnms · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000023 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1000023 · Aviso do Fabricante
• https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-%28NG-NetMS%29.html · Nota