PT-2020-7655 · Ex Libris · Aleph 500

Shady.Liu · Published 2020-01-30 · Updated 2020-02-05 · CVE-2014-3719

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ex Libris ALEPH 500 versions 18.1 through 20

Description The issue concerns multiple SQL injection vulnerabilities in the cgi-bin/review m.cgi component of Ex Libris ALEPH 500. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the find, lib, or sid parameters.

Recommendations For versions 18.1 through 20, consider restricting access to the vulnerable cgi-bin/review m.cgi component until a patch is available. As a temporary workaround, avoid using the find, lib, or sid parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-3719

Affected Products

Aleph 500

References · 4

• 🔥 http://packetstormsecurity.com/files/126635/Aleph-500-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3719 · Security Note
• http://seclists.org/fulldisclosure/2014/May/65 · Note
• https://t.me/cvenotify/667 · Telegram Post