Thru Managed File Transfer Portal 9.0.2 - SQL Injection
2016-02-22T00:00:00
ID 1337DAY-ID-24928 Type zdt Reporter SySS GmbH Modified 2016-02-22T00:00:00
Description
Exploit for asp platform in category web applications
Product: Thru Managed File Transfer Portal
Manufacturer: Thru
Affected Version(s): 9.0.2
Tested Version(s): 9.0.2
Vulnerability Type: SQL Injection (CWE-89)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2015-10-28
Solution Date: 2016-01-22
Public Disclosure: 2016-02-15
CVE Reference: Not yet assigned
Authors of Advisory: Dr. Erlijn van Genuchten, Danny Österreicher
(SySS GmbH)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
Thru Managed File Transfer Portal is a web based file transfer application.
According to the Thru website [1], the application aims to offload large
file transfer to a single platform, to protect files, to replace FTP
servers and to allow access to files anytime, anywhere.
An SQL injection vulnerability was identified in one of the GET request.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The SQL injection vulnerability was found in a GET request that causes
contact data to be sorted. At least the attribute values of sortorder
and letterrange are not correctly sanitized and therefore can be abused
to inject arbitrary SQL statements.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The following HTTP request can be used to show that the SQL statement
causing a delay is executed and results in a 500 server error:
GET /App/asp///contacts.asp?sortorder=1;WAITFOR+DELAY+'0:0:5'--&letterrange=all&fromrec=0&torec=20 HTTP/1.1
Host: [HOST]
Cookie: [COOKIES]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
The reported security vulnerability has been fixed in a new software
release. Update to the new software version.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2015-10-27: Vulnerability discovered
2015-10-28: Vulnerability reported to manufacturer
2016-01-22: Manufacturer announced update
2016-02-15: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] Thru Homepage
http://www.thruinc.com
[2] SySS Security Advisory SYSS-2015-056
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-056.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/
# 0day.today [2018-04-11] #
{"id": "1337DAY-ID-24928", "lastseen": "2018-04-11T11:48:05", "viewCount": 5, "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 2, "enchantments": {"score": {"value": -1.0, "vector": "NONE", "modified": "2018-04-11T11:48:05", "rev": 2}, "dependencies": {"references": [{"type": "zdt", "idList": ["1337DAY-ID-7571", "1337DAY-ID-7569", "1337DAY-ID-7570", "1337DAY-ID-7567", "1337DAY-ID-7572", "1337DAY-ID-7568"]}], "modified": "2018-04-11T11:48:05", "rev": 2}, "vulnersScore": -1.0}, "type": "zdt", "sourceHref": "https://0day.today/exploit/24928", "description": "Exploit for asp platform in category web applications", "title": "Thru Managed File Transfer Portal 9.0.2 - SQL Injection", "cvelist": [], "sourceData": "Product: Thru Managed File Transfer Portal\r\nManufacturer: Thru\r\nAffected Version(s): 9.0.2\r\nTested Version(s): 9.0.2\r\nVulnerability Type: SQL Injection (CWE-89) \r\nRisk Level: High\r\nSolution Status: Open\r\nManufacturer Notification: 2015-10-28\r\nSolution Date: 2016-01-22\r\nPublic Disclosure: 2016-02-15\r\nCVE Reference: Not yet assigned\r\nAuthors of Advisory: Dr. Erlijn van Genuchten, Danny \u00d6sterreicher \r\n (SySS GmbH)\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nOverview:\r\n \r\nThru Managed File Transfer Portal is a web based file transfer application. \r\nAccording to the Thru website [1], the application aims to offload large \r\nfile transfer to a single platform, to protect files, to replace FTP \r\nservers and to allow access to files anytime, anywhere.\r\n \r\nAn SQL injection vulnerability was identified in one of the GET request.\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nVulnerability Details:\r\n \r\nThe SQL injection vulnerability was found in a GET request that causes \r\ncontact data to be sorted. At least the attribute values of sortorder\r\nand letterrange are not correctly sanitized and therefore can be abused\r\nto inject arbitrary SQL statements.\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nProof of Concept (PoC):\r\n \r\nThe following HTTP request can be used to show that the SQL statement \r\ncausing a delay is executed and results in a 500 server error:\r\n \r\nGET /App/asp///contacts.asp?sortorder=1;WAITFOR+DELAY+'0:0:5'--&letterrange=all&fromrec=0&torec=20 HTTP/1.1\r\nHost: [HOST]\r\nCookie: [COOKIES]\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nSolution:\r\n \r\nThe reported security vulnerability has been fixed in a new software\r\nrelease. Update to the new software version.\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nDisclosure Timeline:\r\n \r\n2015-10-27: Vulnerability discovered\r\n2015-10-28: Vulnerability reported to manufacturer\r\n2016-01-22: Manufacturer announced update\r\n2016-02-15: Public release of security advisory\r\n \r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nReferences:\r\n \r\n[1] Thru Homepage\r\n http://www.thruinc.com\r\n[2] SySS Security Advisory SYSS-2015-056\r\n https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-056.txt\r\n[3] SySS Responsible Disclosure Policy\r\n https://www.syss.de/en/news/responsible-disclosure-policy/\n\n# 0day.today [2018-04-11] #", "published": "2016-02-22T00:00:00", "references": [], "reporter": "SySS GmbH", "modified": "2016-02-22T00:00:00", "href": "https://0day.today/exploit/description/24928", "immutableFields": []}