Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.

vendor:

pTransformer ADC

by:

Faudhzan Rahman

7.8

CVSS

HIGH

SQL Injection

CWE

Product Name: pTransformer ADC

Affected Version From: 2.0

Affected Version To: 2.1.7.22827

Patch Exists: YES

Related CWE: CVE-2019-12372

CPE: a:petraware:ptransformer_adc

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro

2019

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.

The login form on pTransformer ADC does not filter dangerous character such as single quote ('). This has cause the application to be vulnerable to SQL Injection. The vulnerable parameter is User ID. By injecting ' or '1'='1'-- ,it will bypass the login form.

Mitigation:

Input validation should be done to filter dangerous characters.

Source

Exploit-DB raw data:

# Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL
Injection via the User ID parameter to the login form.
# Date: 28-05-2019
# Exploit Author: Faudhzan Rahman
# Website: https://faudhzanrahman.blogspot.com/
# Vendor Homepage: http://www.petraware.com
# Version: 2.0
# CVE : CVE-2019-12372
# Tested on: Windows 10 Pro

*Description*

The login form on pTransformer ADC does not filter dangerous character such
as single quote ('). This has cause the application to be vulnerable to SQL
Injection.

*Proof-of-concept*

The vulnerable parameter is User ID. By injecting ' or '1'='1'-- ,it will
bypass the login form.

*Reference*

https://faudhzanrahman.blogspot.com/2019/05/sql-injection-on-login-form.html