Opsview 'service_selection' Parameter SQL Injection Vulnerability
BID:63387
Info
Opsview 'service_selection' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 63387 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5694 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 29 2013 12:00AM |
| Updated: | Nov 07 2013 08:32PM |
| Credit: | J. Oquendo |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Opsview 'service_selection' Parameter SQL Injection Vulnerability
Opsview is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Opsview 4.4.1 are vulnerable.
Opsview is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Opsview 4.4.1 are vulnerable.
Exploit / POC
Opsview 'service_selection' Parameter SQL Injection Vulnerability
An attacker can exploit this issue using a web browser.
The following example data is available:
POST /status/service/acknowledge HTTP/1.1
Content-Length: 118
Content-Type: application/x-www-form-urlencoded
Host: 10.20.30.68:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Opera/5.54 (Windows NT 5.1; U) [en]
comment=&from=http%3a%2f%2f10.20.30.68%2fstatus%2fhostgroup&notify=1&service_selection=%24%7dsql injection goes here%7d&submit=Submit
An attacker can exploit this issue using a web browser.
The following example data is available:
POST /status/service/acknowledge HTTP/1.1
Content-Length: 118
Content-Type: application/x-www-form-urlencoded
Host: 10.20.30.68:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Opera/5.54 (Windows NT 5.1; U) [en]
comment=&from=http%3a%2f%2f10.20.30.68%2fstatus%2fhostgroup&notify=1&service_selection=%24%7dsql injection goes here%7d&submit=Submit
Solution / Fix
Opsview 'service_selection' Parameter SQL Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Opsview 'service_selection' Parameter SQL Injection Vulnerability
References:
References:
- CVE-2013-5694 Blind SQL Injection in Ops View (J. Oquendo)
- Opsview 4.4.1 (Opsview)
- Opsview HomePage (Opsview)