PT-2018-1291

CVE-2018-9245

Publicado

2018-03-03

Atualizado

2018-05-25

Descrição por

CVSS 3.1

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ericsson-LG iPECS NMS (affected versions not specified)

Description The issue is related to a lack of protection for the SQL query structure, allowing for SQL injection. This can be exploited by a remote attacker to bypass the authentication procedure and execute arbitrary code using the id and passwd parameters by sending HTTP POST requests. The vulnerability enables attackers to bypass the login page and execute remote code on the operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Explorabilidade

Exploit

Impactos

Pesquisadores

Berk Cem Göksel

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados

CVE-2018-9245