{"id": "1337DAY-ID-24928", "lastseen": "2018-04-11T11:48:05", "viewCount": 5, "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 2, "enchantments": {"score": {"value": -1.0, "vector": "NONE", "modified": "2018-04-11T11:48:05", "rev": 2}, "dependencies": {"references": [{"type": "zdt", "idList": ["1337DAY-ID-7571", "1337DAY-ID-7569", "1337DAY-ID-7570", "1337DAY-ID-7567", "1337DAY-ID-7572", "1337DAY-ID-7568"]}], "modified": "2018-04-11T11:48:05", "rev": 2}, "vulnersScore": -1.0}, "type": "zdt", "sourceHref": "https://0day.today/exploit/24928", "description": "Exploit for asp platform in category web applications", "title": "Thru Managed File Transfer Portal 9.0.2 - SQL Injection", "cvelist": [], "sourceData": "Product: Thru Managed File Transfer Portal\r\nManufacturer: Thru\r\nAffected Version(s): 9.0.2\r\nTested Version(s): 9.0.2\r\nVulnerability Type: SQL Injection (CWE-89) \r\nRisk Level: High\r\nSolution Status: Open\r\nManufacturer Notification: 2015-10-28\r\nSolution Date: 2016-01-22\r\nPublic Disclosure: 2016-02-15\r\nCVE Reference: Not yet assigned\r\nAuthors of Advisory: Dr. Erlijn van Genuchten, Danny \u00d6sterreicher \r\n (SySS GmbH)\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nOverview:\r\n \r\nThru Managed File Transfer Portal is a web based file transfer application. \r\nAccording to the Thru website [1], the application aims to offload large \r\nfile transfer to a single platform, to protect files, to replace FTP \r\nservers and to allow access to files anytime, anywhere.\r\n \r\nAn SQL injection vulnerability was identified in one of the GET request.\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nVulnerability Details:\r\n \r\nThe SQL injection vulnerability was found in a GET request that causes \r\ncontact data to be sorted. At least the attribute values of sortorder\r\nand letterrange are not correctly sanitized and therefore can be abused\r\nto inject arbitrary SQL statements.\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nProof of Concept (PoC):\r\n \r\nThe following HTTP request can be used to show that the SQL statement \r\ncausing a delay is executed and results in a 500 server error:\r\n \r\nGET /App/asp///contacts.asp?sortorder=1;WAITFOR+DELAY+'0:0:5'--&letterrange=all&fromrec=0&torec=20 HTTP/1.1\r\nHost: [HOST]\r\nCookie: [COOKIES]\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nSolution:\r\n \r\nThe reported security vulnerability has been fixed in a new software\r\nrelease. Update to the new software version.\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nDisclosure Timeline:\r\n \r\n2015-10-27: Vulnerability discovered\r\n2015-10-28: Vulnerability reported to manufacturer\r\n2016-01-22: Manufacturer announced update\r\n2016-02-15: Public release of security advisory\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nReferences:\r\n \r\n[1] Thru Homepage\r\n http://www.thruinc.com\r\n[2] SySS Security Advisory SYSS-2015-056\r\n https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-056.txt\r\n[3] SySS Responsible Disclosure Policy\r\n https://www.syss.de/en/news/responsible-disclosure-policy/\n\n# 0day.today [2018-04-11] #", "published": "2016-02-22T00:00:00", "references": [], "reporter": "SySS GmbH", "modified": "2016-02-22T00:00:00", "href": "https://0day.today/exploit/description/24928", "immutableFields": []}

{}