PT-2019-11271 · Opt/Net Bv · Optoss Next Gen Network Management System

Published 2019-02-04 · Updated 2019-02-06 · CVE-2019-1000023

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) versions v3.6-2 and earlier

Description: The issue allows a malicious attacker to include their own SQL commands, which the database will execute, due to a SQL Injection vulnerability. The vulnerability is exploitable via network connectivity and is identified in the parameters: id, id access type, and id attr access.

Recommendations: For OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) versions v3.6-2 and earlier, consider restricting access to the vulnerable parameters id, id access type, and id attr access to minimize the risk of exploitation. Avoid using these parameters in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-1000023

Affected Products

Optoss Next Gen Network Management System

References · 6

• 🔥 https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-(NG-NetMS).html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000023 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1000023 · Vendor Advisory
• https://owasp.org/index.php/SQL_Injection · Note
• https://sourceforge.net/projects/ngnms · Note
• https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-%28NG-NetMS%29.html · Note