| タイトル | NEWTYPE WebEIP 3.0 Missing Authentication, Authorization Bypass and SQL Injection |
|---|
| 説明 | WebEIP provides companies with websites that employees frequently use, which originally required login to access. However, through the vulnerabilities, it is possible to obtain employee IDs, names, and other information without login, and there is a high chance that employee signatures can be processed.
1. Missing Authorization
- Some of files are read without login. Personnel information, some online archives files information are found.
- /EIP_Com_Selector3_searchDATA.aspx
- /EIP_Com_FileList.aspx
- /EIP_MyPAGE_settingMenu.aspx
- /EIP_MyPAGE.aspx
2. Bypass Authorization
- In the file 'EIP_MyPAGE.aspx', modifying the cookie value is able to result in bypassing authorization. Employee IDs, names, and other staff information without login are found.
3. SQL injection
- In the file '/EIP_Com_Selector3_searchDATA.aspx', the parameter "data" does not properly sanitize user input before using it in an SQL query.
- Because of Missing Authorization, this vulnerability allows for SQL injection attacks without login.
- This can be exploited by sending a crafted request to the login endpoint with malicious SQL code.
|
|---|
| ソース | ⚠️ https://drive.google.com/file/d/1BJhYjqSvYpAB2ZJGR8vD_COeICxrXNlu/view?usp=drive_link |
|---|
| ユーザー | ox882 (UID 98191) |
|---|
| 送信 | 2026年06月09日 08:47 (2 月 ago) |
|---|
| モデレーション | 2026年08月03日 09:27 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 385531 [NewType WebEIP 迄 3.0 /EIP_Com_FileList.aspx 弱い認証] |
|---|
| ポイント | 20 |
|---|