PT-2018-9746 · Elo · Eloprofessional+1

Jens Regel · Published 2018-07-11 · Updated 2018-09-11 · CVE-2018-10197

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ELOenterprise versions 9.0.0 through 9.18.039 ELOenterprise versions 10.0.0 through 10.18.039 ELOprofessional versions 9.0.0 through 9.18.039 ELOprofessional versions 10.0.0 through 10.18.039

Description: The issue allows for time-based blind SQL injection, enabling the reading of all database content. This is made possible through the ticket HTTP GET parameter. For instance, it can be used to read the password hash of the administrator user in the userdata table from the eloam database.

Recommendations: For ELOenterprise versions 9.0.0 through 9.18.039, update to version 9.18.040 or later. For ELOenterprise versions 10.0.0 through 10.18.039, update to version 10.18.040 or later. For ELOprofessional versions 9.0.0 through 9.18.039, update to version 9.18.040 or later. For ELOprofessional versions 10.0.0 through 10.18.039, update to version 10.18.040 or later. As a temporary workaround, consider restricting access to the ticket HTTP GET parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-10197

Affected Products

Eloenterprise

Eloprofessional

References · 3

• 🔥 http://seclists.org/fulldisclosure/2018/Jul/29 · Exploit
• https://osv.dev/vulnerability/CVE-2018-10197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10197 · Security Note