Sage XRT Business Exchange SQL注入漏洞

Sage XRT Business Exchange is part of the Sage suite of applications from Sage UK. A SQL injection vulnerability exists in Sage XRT Business Exchange version 12.4.302, which originates from a vulnerability that allows an authenticated attacker to inject malicious data into SQL queries: add...

Sage XRT Business Exchange 跨站脚本漏洞

Sage XRT Business Exchange is part of the Sage suite of applications from Sage UK. A security vulnerability exists in Sage XRT Business Exchange version 12.4.302 that stems from the presence of stored XSS, which allows an attacker to execute JavaScript code in the context of another user's browse...

CVE-2022-34324

Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History...

CVE-2022-34323

Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Filters and Display model...

CVE-2022-34324

Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History...

CVE-2022-34324

Sage XRT Business Exchange 12.4.302 is affected by SQL injection vulnerabilities in the areas Add Currencies, Payment Order, and Transfer History. The issue allows an authenticated attacker to inject malicious data into SQL queries. No exploit details or public patch information are provided in t...

PT-2023-13358 · Sage · Sage Xrt Business Exchange

Name of the Vulnerable Software and Affected Versions: Sage XRT Business Exchange version 12.4.302 Description: Multiple XSS issues were discovered in Sage XRT Business Exchange that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be...

PT-2023-13357 · Sage · Sage Enterprise Intelligence

Name of the Vulnerable Software and Affected Versions: Sage Enterprise Intelligence version 2021 R1.1 Description: Multiple XSS issues were discovered that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerabl...

CVE-2021-45492

In Sage 300 ERP formerly accpac through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions...

CVE-2021-45492

In Sage 300 ERP formerly accpac through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions...

CVE-2021-45492

In Sage 300 ERP formerly accpac through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions...

Design/Logic Flaw

In Sage 300 ERP formerly accpac through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions...

CVE-2021-45492

CVE-2021-45492 affects Sage 300 ERP (through 6.8.x). The installer places C:\Sage\Sage300\Runtime at the front of the system PATH, and this directory is writable by unprivileged users due to weak C:\ permissions inherited by the installer. Because PATH entries are used for DLL search order, an at...

CVE-2021-45492

In Sage 300 ERP formerly accpac through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions...

Sage 300 代码问题漏洞

Sage 300 is a well-established closed-source enterprise resource planning ERP solution from Sage designed to facilitate business management. A security vulnerability exists in Sage 300 ERP version 6.8.x and prior versions, which stems from an inability to set explicit permissions, resulting in th...

PT-2022-12371 · Sage · Sage 300 Erp

Name of the Vulnerable Software and Affected Versions: Sage 300 ERP versions through 6.8.x Description: The installer configures the C:SageSage300Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because...

Metasploit Wrap-Up

Now I Control Your Resource Planning Servers Sage X3 is a resource planning product designed by Sage Group which is designed to help established businesses plan out their business operations. But what if you wanted to do more than just manage resources? What if you wanted to hijack the resource...

CVE-2020-7388

Sage X3 Unauthenticated Remote Command Execution RCE as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by...

CVE-2020-7387

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

CVE-2020-7389

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...