PT-2018-17045 · Docutrac · Office Therapy+2

Published 2018-03-19 · Updated 2019-10-09 · CVE-2018-5552

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DocuTrac QuicDoc and Office Therapy versions with DTISQLInstaller.exe version 1.6.4.0 and prior

Description The issue concerns a hard-coded cryptographic salt, S@l+&pepper, which is used in the affected software. This could potentially lead to security issues, as hard-coded values can be easily discovered and exploited.

Recommendations For versions with DTISQLInstaller.exe version 1.6.4.0 and prior, consider updating DTISQLInstaller.exe to a version later than 1.6.4.0 to mitigate the risk associated with the hard-coded cryptographic salt.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-760

Related Identifiers

CVE-2018-5552

Affected Products

Dtisqlinstaller.Exe

Docutrac Quicdoc

Office Therapy

References · 3

• 🔥 https://blog.rapid7.com/2018/03/14/r7-2018-01-cve-2018-5551-cve-2018-5552-docutrac-office-therapy-installer-hard-coded-credentials-and-cryptographic-salt · Exploit
• https://osv.dev/vulnerability/CVE-2018-5552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5552 · Security Note