RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities

2010-04-14T00:00:00
ID EDB-ID:12242
Type exploitdb
Reporter wsn1983
Modified 2010-04-14T00:00:00

Description

RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities. Webapps exploit for jsp platform

                                        
                                            RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities



Vulnerable: v3.0.7.x

Vendor:  www.rj-itop.com<http://www.rj-itop.com>

Category: Input Validation Error

Impact:   SQL injection



Details:

=========

Multiple SQL Injection Vulnerabilities has been found in DRJ-iTop Network Vulnerability Scanner System, which can be exploited by malicious users to conduct SQL injection and script insertion attacks.

Authentication is required to exploit these vulnerabilities.



POC:

=========

https://8.8.8.8/roleManager.jsp?type=query&id= [SQL Injection]





Timeline:

========

2009.10.19   Report to vendor (but vender did not respond)

2009.11.15   Report to vendor second times

2009.11.19   Report to CNNVD

2010.04.13   Public