PT-2018-1291

CVE-2018-9245

Published

2018-03-03

Updated

2018-05-25

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ericsson-LG iPECS NMS (affected versions not specified)

Description The issue is related to a lack of protection for the SQL query structure, allowing for SQL injection. This can be exploited by a remote attacker to bypass the authentication procedure and execute arbitrary code using the id and passwd parameters by sending HTTP POST requests. The vulnerability enables attackers to bypass the login page and execute remote code on the operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Berk Cem Göksel

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2018-9245