PT-2019-8010 · Orpak · Orpak Siteomat

Published 2019-06-03 · Updated 2019-06-04 · CVE-2017-14851

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orpak SiteOmat versions prior to 2017-09-25

Description A SQL injection issue exists in the login page of the affected software, specifically in the authentication validation process, which contains an insecure SELECT query. This allows for authentication bypass.

Recommendations For Orpak SiteOmat versions prior to 2017-09-25, consider updating to a version released after 2017-09-25 to resolve the issue. As a temporary workaround, restrict access to the login page to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-14851

Affected Products

Orpak Siteomat

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-14851 · Security Note
• https://orpak.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14851 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01 · Note
• http://securityfocus.com/bid/108167 · Note
• https://t.me/cibsecurity/4652 · Telegram Post