OCS Inventory NG - Multiple SQL Injections

vendor:

OCS Inventory NG

by:

milw0rm.com

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: OCS Inventory NG

Affected Version From: OCS Inventory NG 1.02 (Unix)

Affected Version To: OCS Inventory NG 1.02 (Unix)

Patch Exists: Yes

Related CWE: N/A

CPE: a:ocsinventory-ng:ocs_inventory_ng

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix

2009

OCS Inventory NG – Multiple SQL Injections

The Open Computer and Software (OCS) Inventory Next Generation (NG) provides relevant inventory information about system configurations and software on the network. The server can be managed using a web interface. It was found that the application does not properly sanitize user input which results into multiple SQL injections. Affected are the following scripts: download.php (parameters `N', `DL', `O' and `V') and group_show.php (parameter `SYSTEMID'); Attackers may be able to manipulate SQL statements in such a way that they can retrieve, create or modify information stored in the database. Furthermore, the SQL injection might allow attackers to get a foothold on the underlying system. The vulnerability can be exploited by just using a web browser: http://example.org/ocsreports/download.php?n=1&dl=2&o=3&v=4'union+all+select+concat(id,':',passwd)+from+operators%23

Mitigation:

Vendor has been notified and the vulnerability has been fixed.

Source

Exploit-DB raw data:

OCS Inventory NG - Multiple SQL Injections (May 30 2009)
_______________________________________________________________________________


* Product

  Open Computer and Software (OCS) Inventory NG
  (http://www.ocsinventory-ng.org/)

* Vulnerable Versions

  OCS Inventory NG 1.02 (Unix)


* Vendor Status

  Vendor has been notified and the vulnerability has been fixed.


* Details

  The Open Computer and Software (OCS) Inventory Next Generation (NG)
provides relevant inventory information about system configurations and
software on the network. The server can be managed using a web
interface. It was found that the application does not properly sanitize
user input which results into multiple SQL injections.

  Affected are the following scripts:

  - download.php (parameters `N', `DL', `O' and `V')
  - group_show.php (parameter `SYSTEMID');

* Impact

  Attackers may be able to manipulate SQL statements in such a way that
they can retrieve, create or modify information stored in the database.
Furthermore, the SQL injection might allow attackers to get a foothold
on the underlying system.

* Exploit

  The vulnerability can be exploited by just using a web browser:

	http://example.org/ocsreports/download.php?n=1&dl=2&o=3&v=4'union+all+select+concat(id,':',passwd)+from+operators%23

# milw0rm.com [2009-06-01]