PT-2018-1291 · Ericsson Lg · Ericsson-Lg Ipecs Nms

Berk Cem Göksel · Published 2018-03-03 · Updated 2018-05-25 · CVE-2018-9245

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ericsson-LG iPECS NMS (affected versions not specified)

Description The issue is related to a lack of protection for the SQL query structure, allowing for SQL injection. This can be exploited by a remote attacker to bypass the authentication procedure and execute arbitrary code using the id and passwd parameters by sending HTTP POST requests. The vulnerability enables attackers to bypass the login page and execute remote code on the operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2018-00787

CVE-2018-9245

Affected Products

Ericsson-Lg Ipecs Nms

References · 5

• 🔥 https://exploit-db.com/exploits/44515 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9245 · Security Note
• https://bdu.fstec.ru/vul/2018-00787 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9245 · Vendor Advisory
• https://gist.github.com/berkgoksel/99ba5c1f3f9f6e4e33e7ad966c007693 · Note