IBM Marketing Platform up to 8.5.x/8.6.x/9.1.2.1 sql injection

Summaryinfo

A vulnerability was found in IBM Marketing Platform up to 8.5.x/8.6.x/9.1.2.1. It has been rated as critical. This impacts an unknown function. The manipulation leads to sql injection. This vulnerability is documented as CVE-2016-0224. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in IBM Marketing Platform up to 8.5.x/8.6.x/9.1.2.1 (Marketing Software). It has been rated as very critical. This issue affects an unknown function. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

The weakness was released 06/28/2016 (Website). The advisory is shared at www-01.ibm.com. The identification of this vulnerability is CVE-2016-0224 since 12/08/2015. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/12/2019). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 9.1.2.2 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-88362 and VDB-88363. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Marketing Software

Vendor

• IBM

Name

• Marketing Platform

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 9.1.2.0
• 9.1.2.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion