PT-2014-4472 · Innovative · Vtls-Virtua

José Tozo · Published 2014-10-20 · Updated 2015-01-26 · CVE-2014-2081

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Innovative vtls-Virtua versions prior to 2013.2.4 Innovative vtls-Virtua versions 2014.x prior to 2014.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username or password parameter in the login functionality of the web reports/cgi-bin/InfoStation.cgi endpoint.

Recommendations For versions prior to 2013.2.4, update to version 2013.2.4 or later. For versions 2014.x prior to 2014.1.1, update to version 2014.1.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-2081

Affected Products

Vtls-Virtua

References · 4

• 🔥 http://seclists.org/fulldisclosure/2014/Aug/64 · Exploit
• 🔥 https://exploit-db.com/exploits/34420 · Exploit
• 🔥 http://packetstormsecurity.com/files/127997/VTLS-Virtua-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2081 · Security Note