vendor:
IGI
by:
Mohamed Sayed
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: IGI
Affected Version From: 5.2.3.2
Affected Version To: 5.2.3.2
Patch Exists: YES
Related CWE: CVE-2018-1756
CPE: a:ibm:igi:5.2.3.2
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10
2018
Unauthenticated Remote SQLi
IBM IGI version 5.2.3.2 is suffering from unauthenticated remote SQLi. The vulnerability enable remote unauthenticated attacker to take over the server database and affect the confidentiality, integrity and availability of the system. The vulnerability is in the survey end point API /survey/api/config?userId=XXX, where the userId parameter value is injected directly to a sql query without sensitization nor validation and by exploiting it the attacker will be able to gain access on the server database.
Mitigation:
Input validation and sanitization should be implemented to prevent SQL injection attacks.
