PT-2017-14970 · Zuuse · Zuuse Beims Contractorweb

Rajwinder Singh · Published 2017-12-18 · Updated 2019-03-21 · CVE-2017-17721

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0

Description The issue allows SQL injection via certain parameters. The vulnerable parameters include tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus.

Recommendations For ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0, consider restricting access to the affected parameters to minimize the risk of exploitation. Avoid using the parameters tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-17721

Affected Products

Zuuse Beims Contractorweb

References · 8

• 🔥 https://exploit-db.com/exploits/43379 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17721 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17721 · Vendor Advisory
• https://cxsecurity.com/issue/WLB-2017120155 · Note
• https://packetstormsecurity.com/files/145511/BEIMS-ContractorWeb-5.18.0.0-SQL-Injection.html · Note
• https://becomepentester.blogspot.com/2017/12/ZUUSE-BEIMS-ContractorWeb-SQLInjection-CVE-2017-17721.html · Note
• https://cyber-security.ro/blog/2017/12/20/beims-contractorweb-5-18-0-0-sql-injection · Note
• https://0day.today/exploit/29277 · Note