PT-2019-9067 · Polaris Ft · Polaris Ft Intellect Core Banking

Hai Dang Long + 1 · Publicado 2019-04-30 · Atualizado 2019-05-03 · CVE-2018-14874

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Polaris FT Intellect Core Banking version 9.7.1

Description An issue in the Armor module allows SQL injection with an authenticated session. This occurs because input passed through the code parameter in certain pages, such as "collaterals/colexe3t.jsp", "/references/refsuppu.jsp", and "/references/refbranu.jsp", is mishandled before being used in SQL queries.

Recommendations For Polaris FT Intellect Core Banking version 9.7.1, consider restricting access to the affected pages, specifically "collaterals/colexe3t.jsp", "/references/refsuppu.jsp", and "/references/refbranu.jsp", to minimize the risk of exploitation. Avoid using the code parameter in these pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-14874

Produtos afetados

Polaris Ft Intellect Core Banking

Referências · 3

• 🔥 https://neetech18.blogspot.com/2019/03/error-based-sql-injection-vulnerability.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14874 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14874 · Aviso do Fabricante