Telecommunication Software SAMwin Contact Center Suite 5.1 Database SAMwinLIBVB.dll getCurrentDBVersion sql injektion

Det var en kritisksvag punkt upptäcktes i Telecommunication Software SAMwin Contact Center Suite 5.1. Som påverkar funktionen getCurrentDBVersion hos två bibliotek SAMwinLIBVB.dll av komponenten Database Handler. Manipulering en okänd ingång leder till en sårbarhet klass sql injektion svag punkt. Den rådgivande finns tillgänglig för nedladdning på modzero.ch. Kombinerades med tillverkarens på en publikation. Denna svaga punkt är känd som CVE-2013-10003. Attacken på nätet kan. Det finns tekniska detaljer känd. Han deklarerade proof-of-concept. Den exploit kan laddas ner från modzero.ch. Minst 174 dagar var den svaga punkten som 0-day. En uppgradering till den version 6.2 att åtgärda problemet. Som bläst uppdatera till den senaste versionen åtgärder rekommenderas. En möjlig åtgärd har utfärdats före och inte bara efter offentliggörandet.

Fält03/04/2014 17:2131/03/2019 22:0524/05/2022 15:14
vendorTelecommunication SoftwareTelecommunication SoftwareTelecommunication Software
nameSAMwin Contact Center SuiteSAMwin Contact Center SuiteSAMwin Contact Center Suite
version5.15.15.1
componentDatabase HandlerDatabase HandlerDatabase Handler
librarySAMwinLIBVB.dllSAMwinLIBVB.dllSAMwinLIBVB.dll
functiongetCurrentDBVersiongetCurrentDBVersiongetCurrentDBVersion
affectedlistTelecommunication Software SAMwin Contact Center Suite 5.1 Telecommunication Software SAMwin Agent 5.01.19.06Telecommunication Software SAMwin Contact Center Suite 5.1 Telecommunication Software SAMwin Agent 5.01.19.06Telecommunication Software SAMwin Contact Center Suite 5.1 Telecommunication Software SAMwin Agent 5.01.19.06
vendorinformdate137963520013796352001379635200
risk222
historic000
cvss2_vuldb_basescore5.85.85.8
cvss2_vuldb_tempscore4.34.34.3
cvss2_vuldb_avNNN
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiNNN
cvss3_meta_basescore6.56.56.5
cvss3_meta_tempscore5.65.65.6
cvss3_vuldb_basescore6.56.56.5
cvss3_vuldb_tempscore5.65.65.6
advisoryquoteDue to the absence of any middleware sanitizing and verifying input data send by the SAMwin Agent, arbitrary SQL commands can be executed from the username field of the SAMwin Agent login mask. When a SAMwin Agent user logs in, the username and password will be compared against values that are stored in the database. By terminating the username with a single quote character, any person with access to the SAMwin Agent login form can execute malicious SQL statements. For example, the following string can be used as username to verify the SQL command execution on the SQL server.Due to the absence of any middleware sanitizing and verifying input data send by the SAMwin Agent, arbitrary SQL commands can be executed from the username field of the SAMwin Agent login mask. When a SAMwin Agent user logs in, the username and password will be compared against values that are stored in the database. By terminating the username with a single quote character, any person with access to the SAMwin Agent login form can execute malicious SQL statements. For example, the following string can be used as username to verify the SQL command execution on the SQL server.Due to the absence of any middleware sanitizing and verifying input data send by the SAMwin Agent, arbitrary SQL commands can be executed from the username field of the SAMwin Agent login mask. When a SAMwin Agent user logs in, the username and password will be compared against values that are stored in the database. By terminating the username with a single quote character, any person with access to the SAMwin Agent login form can execute malicious SQL statements. For example, the following string can be used as username to verify the SQL command execution on the SQL server.
date1394668800 (13/03/2014)1394668800 (13/03/2014)1394668800 (13/03/2014)
locationWebsiteWebsiteWebsite
typeAdvisoryAdvisoryAdvisory
urlhttp://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txthttp://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txthttp://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txt
identifierMZ-13-06MZ-13-06MZ-13-06
coordination111
person_nameTobias Ospelt/Max MoserTobias Ospelt/Max MoserTobias Ospelt/Max Moser
company_namemodzero AGmodzero AGmodzero AG
confirm_date1379980800 (24/09/2013)1379980800 (24/09/2013)1379980800 (24/09/2013)
availability111
date1394668800 (13/03/2014)1394668800 (13/03/2014)1394668800 (13/03/2014)
publicity111
urlhttp://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txthttp://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txthttp://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txt
developer_nameTobias Ospelt/Max MoserTobias Ospelt/Max MoserTobias Ospelt/Max Moser
languageSQLSQLSQL
price_0day$0-$5k$0-$5k$0-$5k
nameUpgradeUpgradeUpgrade
upgrade_version6.26.26.2
seealso127881278812788
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_rcURURUR
cvss3_vuldb_ePPP
cvss3_vuldb_rlOOO
cvss3_vuldb_rcRRR
0day_days174174174
cvss3_vuldb_prNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aNNN
cwe089 (sql injektion)89 (sql injektion)
cveCVE-2013-10003
responsibleVulDB

◂ TidigareÖversiktNästa ▸

Do you know our Splunk app?

Download it now for free!