PT-2019-15940 · Octeth · Octeth Oempro

Bruno De Barros Bulle · Publicado 2019-12-12 · Atualizado 2023-01-28 · CVE-2019-19740

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Octeth Oempro versions 4.7 through 4.8

Description The issue allows SQL injection. The parameter CampaignID in the Campaign.Get endpoint is vulnerable.

Recommendations For versions 4.7 and 4.8, avoid using the CampaignID parameter in the Campaign.Get endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the Campaign.Get endpoint to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-19740

Produtos afetados

Octeth Oempro

Referências · 7

• 🔥 http://packetstormsecurity.com/files/156113/Octeth-Oempro-4.8-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/47967 · Exploit
• https://t.me/cvenotify/43002 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-19740 · Aviso do Fabricante
• https://www2.octeth.com/blog · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19740 · Nota de Segurança
• https://github.com/BrunoBulle/Oempro_4.7/blob/master/README.md · Nota