Advisory ID: SYSS-2018-012
Many input fields are vulnerable to SQL injection. An SQL injection allows typically an attacker to execute almost arbitrary SQL commands. It is possible to break out of the original query with an uptick, append a custom query and fix the syntax. The application supports Firebird and MS SQL database servers. Stacked queries do not work with both database servers. One of the vulnerable input fields is the user name within the login form. This allows even unauthenticated users to exploit the application. Because the authentication process is implemented in the client application, the SQL injection in the login form does not allow a login bypass. The most promising real-life attack among other possible attacks is to steal the encrypted passphrase of the users.