PT-2017-9622 · Ecava · Ecava Integraxor

Brian Gorenc + 1 · Published 2017-02-07 · Updated 2017-03-01 · CVE-2016-8341

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor version 5.0.413.0

Description The issue concerns SQL injection vulnerability in the Ecava IntegraXor web server. Specifically, parameters are not properly sanitized, which could allow an attacker to execute read, write, and delete commands on the host's database. The getdata parameter is mentioned as being vulnerable to SQL injection, potentially leading to remote code execution.

Recommendations For Ecava IntegraXor version 5.0.413.0, consider restricting access to the getdata parameter in the web server to minimize the risk of exploitation until a patch is available. As a temporary workaround, ensure that all queries are properly sanitized to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-8341

ZDI-17-058

ZDI-17-059

Affected Products

Ecava Integraxor

References · 6

• https://zerodayinitiative.com/advisories/ZDI-17-059 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-058 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8341 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8341 · Vendor Advisory
• http://securityfocus.com/bid/95907 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-031-02 · Note