OV3 Online Administration 3.0 Multiple Unauthenticated SQL Injection Vulnerabilities
Title: OV3 Online Administration 3.0 Multiple Unauthenticated SQL Injection Vulnerabilities
Advisory ID: ZSL-2017-5412
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data
Risk: (4/5)
Release Date: 30.05.2017
PHP/5.3.3
Apache/2.2.15
MySQL/5.0.11
[26.12.2016] Vulnerability discovered.
[29.05.2017] No response from the vendor.
[30.05.2017] Public security advisory released.
[2] https://packetstormsecurity.com/files/142750
[3] https://cxsecurity.com/issue/WLB-2017050223
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/126632
[02.06.2017] - Added reference [1], [2] and [3]
[08.06.2017] - Added reference [4]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2017-5412
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data
Risk: (4/5)
Release Date: 30.05.2017
Summary
With the decision to use the OV3 as a platform for your data management, the course is set for scalable, flexible and high-performance applications. Whether you use the OV3 for your internal data management or use it for commercial business applications such as shops, portals, etc. Thanks to the data-based structure of the OV3, you always have the best tool at your fingertips. The OV3 is a 100% web-based tool. This eliminates the need to install a new software on all participating client computers. All elements are operated by a standard browser. Further advantages are the location-dependent use and - particularly with ASP solutions - the reduced costs for local hardware like own servers and modern client workstations.Description
OV3 suffers from multiple SQL Injection vulnerabilities. Input passed via multiple GET and POST parameters, including the User-Agent HTTP header, is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.Vendor
novaCapta Software & Consulting GmbH - http://www.meacon.deAffected Version
3.0Tested On
CentOS release 6.8 (Final)PHP/5.3.3
Apache/2.2.15
MySQL/5.0.11
Vendor Status
[14.11.2016] Vendor contacted.[26.12.2016] Vulnerability discovered.
[29.05.2017] No response from the vendor.
[30.05.2017] Public security advisory released.
PoC
ov3_sqli.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://www.exploit-db.com/exploits/42097/[2] https://packetstormsecurity.com/files/142750
[3] https://cxsecurity.com/issue/WLB-2017050223
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/126632
Changelog
[30.05.2017] - Initial release[02.06.2017] - Added reference [1], [2] and [3]
[08.06.2017] - Added reference [4]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
