PT-2018-4439 · Rxtec · Radmin

Thomas Konrad · Published 2018-09-24 · Updated 2018-11-13 · CVE-2015-8298

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RXTEC RXAdmin UPDATE 06 / 2012

Description The issue concerns SQL injection vulnerabilities in the login page. Remote attackers can execute arbitrary SQL commands by manipulating specific parameters to the index.htm page, including the loginpassword, loginusername, zusatzlicher, and groupid parameters, or by altering the rxtec cookie.

Recommendations For RXTEC RXAdmin UPDATE 06 / 2012, consider restricting access to the login page until a fix is available, and avoid using the vulnerable parameters loginpassword, loginusername, zusatzlicher, and groupid in the index.htm page, as well as the rxtec cookie.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-8298

Affected Products

Radmin

References · 4

• 🔥 http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8298 · Security Note
• https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513 · Note
• http://seclists.org/fulldisclosure/2015/Nov/90 · Note