Application Vulnerability

vendor:

Application

by:

K053

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Application

Affected Version From: All below 1389

Affected Version To: 1389

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

The application is vulnerable in several sections, however, until version 1389, the Research Plans section is vulnerable. In the Research Plans section, there is a form with no input validation in the email field. An attacker can submit a query in the email field and leave the password field empty to get the DBMS version.

Mitigation:

Input validation should be implemented in the email field.

Source

Exploit-DB raw data:

# Author: K053  <K053.dev0te3 at gmail>
# Vendor : SIDA < http://91.98.156.224/ >
# Version: All below 1389 are vulberable
====================================================================================
Note: Seems vendor patched this vulnerability in newest update [ 1389]
so we decide to public it now. Maybe more in future ;)

====================================================================================
Detail: Application is vulnerable in several section. seems developer
fixed most of them but until version 1389 Research Plans section is 
vulnerable. In Research Plans section there is form which there is no 
input validation in email field.

====================================================================================
POC: Application powered by Oracle DBMS. Submit this query in email field
and let password field empty to get DBMs version.

http://address/Portal/Research/ResearchPlan/UserStart.aspx

'or 1=utl_inaddr.get_host_address((select banner from v$version where rownum=1))--

====================================================================================
Dork: just search for "سیدا"

====================================================================================
~Blackout Frenzy  [http://b0f.ir]