Horizon Business Services Caterease up to 24.0.1.2405 TCP Packet sql injection

Summaryinfo

A vulnerability identified as critical has been detected in Horizon Business Services Caterease up to 24.0.1.2405. Affected by this issue is some unknown functionality of the component TCP Packet Handler. This manipulation causes sql injection. This vulnerability appears as CVE-2024-38889. The attacker needs to be present on the local network. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component TCP Packet Handler. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command.

The bug was discovered 04/27/2024. The weakness was presented with jTag Labs as security advisory (VulDB). The public release was coordinated in cooperation with Horizon Business Services. Caterease is vulnerable to SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability allows attackers to exploit the software by injecting malicious SQL queries through TCP packet injection techniques. Attackers can craft custom TDS payloads that bypass normal input validation and execute arbitrary SQL commands on the database. This vulnerability is known as CVE-2024-38889 since 06/21/2024. The exploitation appears to be easy. The attack can only be initiated within the local network. The exploitation doesn't need any form of authentication. Technical details are unknown but a private exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

A private exploit has been developed by Skelet4r in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 96 days. During that time the estimated underground price was around . Although an exploit is not currently publicly available, a proof-of-concept exploit has been developed by Skelet4r and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. To exploit this vulnerability, an attacker can utilize TCP packet injection techniques to inject custom packets into the client-to-server TCP stream. By using specially crafted TDS payloads within the injected TCP packets, the attacker can execute malicious SQL queries within the SQL database.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383229: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-89: Improper Neutralization of Special Elements used in an S (by jTag Labs)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion