A vulnerability classified as critical has been found in Mensch und Maschine MapEdit 3.2.6.0. This affects an unknown code block of the file /Mum.Geo.Services/DataAccessService.svc. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 06/07/2016. The weakness was shared 09/13/2016 by Paul Baade and Sven Krewitt as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The exploitability is told to be easy. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Technical details and a public exploit are known. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

After immediately, there has been an exploit disclosed. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 52 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 6.2.74 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The entries 91718, 91720, 91721 and 91722 are related to this item.

Productinfo

Vendor

• Mensch und Maschine

Name

• MapEdit

Version

• 3.2.6.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion