DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection

2012-06-03T00:00:00
ID SECURITYVULNS:DOC:28119
Type securityvulns
Reporter Securityvulns
Modified 2012-06-03T00:00:00

Description

Title

DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection

Severity

High

Date Discovered

April 12, 2012

Discovered By

Digital Defense, Inc. Vulnerability Research Team Credit: Chris Graham and r@b13$

Vulnerability Description

Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability in the Epicor Returns Management software SOAP interface. Left unremediated, this vulnerability could be leveraged by an attacker to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host operating system.

Solution Description

Epicor Software Corporation has confirmed they have now contacted the customers affected, and have made an update available to address this vulnerability. As such, DDI recommends restricting access to the affected port/interface until installing the Epicor update or implementing another workaround to address the issue.

It should be noted that Epicor has advised DDI that the codebase for Returns Management software may differ significantly from customer to customer. Epicor has suggested that some customer installs may not contain this specific vulnerability as a result of this codebase variability.

DDI recommends that any customer currently utilizing Epicor Returns Management software within their enterprise install the update Epicor has made available and, if concerned about the applicability of the update, log a support call with Epicor directly to determine if their codebase contains this vulnerability.

Tested Systems / Software (with versions)

Epicor Returns Management Windows Server 2003 Microsoft SQL Server 2000 Platform: Apache Tomcat/4.1.31

Vendor Contact

Epicor Software Corporation www.epicor.com