EUVD-2017-8877

Malware in sbrugna...

ZUUSE BEIMS ContractorWeb .NET Cross-Site Request Forgery Vulnerability

ZUUSE BEIMS ContractorWeb .NET is a suite of infrastructure management software from ZUUSE Australia. A cross-site request forgery vulnerability exists in the /CWEBNET/ authenticated page in ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0. A remote attacker could exploit this vulnerability to...

PT-2018-16898

Name of the Vulnerable Software and Affected Versions ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0 Description The issue allows for Cross-Site Request Forgery CSRF attacks on authenticated pages, specifically those under the "/CWEBNET/" endpoint. A successful attack can force a user to perform...

PT-2018-16897

Name of the Vulnerable Software and Affected Versions ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0 Description The issue allows access to various privileged modules, such as "UserManagement", without properly authenticating the user. This can be exploited by an attacker to perform unauthorized...

PT-2017-14970

Name of the Vulnerable Software and Affected Versions ZUUSE BEIMS ContractorWeb .NET version 5.18.0.0 Description The issue allows SQL injection via certain parameters. The vulnerable parameters include tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, o...