PT-2019-9067 · Polaris Ft · Polaris Ft Intellect Core Banking

Hai Dang Long + 1 · Published 2019-04-30 · Updated 2019-05-03 · CVE-2018-14874

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Polaris FT Intellect Core Banking version 9.7.1

Description An issue in the Armor module allows SQL injection with an authenticated session. This occurs because input passed through the code parameter in certain pages, such as "collaterals/colexe3t.jsp", "/references/refsuppu.jsp", and "/references/refbranu.jsp", is mishandled before being used in SQL queries.

Recommendations For Polaris FT Intellect Core Banking version 9.7.1, consider restricting access to the affected pages, specifically "collaterals/colexe3t.jsp", "/references/refsuppu.jsp", and "/references/refbranu.jsp", to minimize the risk of exploitation. Avoid using the code parameter in these pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-14874

Affected Products

Polaris Ft Intellect Core Banking

References · 3

• 🔥 https://neetech18.blogspot.com/2019/03/error-based-sql-injection-vulnerability.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14874 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14874 · Vendor Advisory