PT-2010-4208 · Sap · Topmanage Olk

Published 2010-07-09 · Updated 2018-10-10 · CVE-2010-2686

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TopManage OLK module version 1.91.30 for SAP

Description The issue allows remote attackers to execute arbitrary SQL commands via vulnerable parameters in the clientes.asp file. Specifically, the PriceFrom, PriceTo, and InvFrom parameters are affected, as reachable from the "olk/c p/searchCart.asp" endpoint and other unspecified vectors when performing an advanced search.

Recommendations For TopManage OLK module version 1.91.30, avoid using the PriceFrom, PriceTo, and InvFrom parameters in the affected API endpoint until the issue is resolved. Restrict access to the clientes.asp file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-2686

Affected Products

Topmanage Olk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-2686 · Security Note
• http://secunia.com/advisories/40424 · Vendor Advisory
• http://securityfocus.com/bid/41208 · Note
• http://securityfocus.com/archive/1/512135 · Note
• http://securityfocus.com/archive/1/512084/100/0/threaded · Note