Deltek Vision up to 7.6 RPC over HTTP SQL sql injection

Summaryinfo

A vulnerability labeled as critical has been found in Deltek Vision up to 7.6. Impacted is an unknown function of the component RPC over HTTP Handler. Such manipulation leads to sql injection (SQL). This vulnerability is listed as CVE-2018-18251. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Deltek Vision up to 7.6. It has been rated as critical. Affected by this issue is an unknown part of the component RPC over HTTP Handler. The manipulation with an unknown input leads to a sql injection vulnerability (SQL). Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on the client binary to enforce security rules and integrity of SQL statements and other content being sent to the server. Client HTTP calls can be manipulated by one of several means to execute arbitrary SQL statements (similar to SQLi) or possibly have unspecified other impact via this custom protocol. To perform these attacks an authenticated session is first required. In some cases client calls are obfuscated by encryption, which can be bypassed due to hard-coded keys and an insecure key rotation protocol. Impacts may include remote code execution in some deployments; however, the vendor states that this cannot occur when the installation documentation is heeded.

The weakness was presented 04/24/2019 (Website). The advisory is available at vsecurity.com. This vulnerability is handled as CVE-2018-18251 since 10/11/2018. The attack may be launched remotely. A simple authentication is necessary for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Deltek

Name

• Vision

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion