SAP's web module OLK SQL Injection vulnerability

From: salchoman@gmail.com
To: bugtraq@securityfocus.com
Cc:
Subject: SAP's web module OLK SQL Injection vulnerability
Date:


#################################################
###### SAP's web module OLK: SQL Injection ######
#################################################

$ Author: salcho - salchoman@gmail.com
$ Home  : CSL Labs
$ Date  : 27/06/2010

$#########################################################

[+] Vendor  : http://www.topmanage.com.pa/

[+] Product : http://www.topmanage.com.pa/products/1/

[+] Version : 1.91.30 [Prior versions might be vulnerable too.]

[+] Dork    : inurl: /olk/c_p

$#######################DISCLAIMER########################
The author does not take any responsibility for the use this 
information might be put to. All the information provided
here is for educational purposes only. The authir is no way 
responsible for any misuse of the information.

$#####################SQL INJECTION#######################

[+] Affected: /olk/c_p/searchCart.asp

[+] Description : The forms Price From, Price To, Inventory
        greater than, and some others in the "Advanced
        Search" are vulnerable to SQL Injection allowing
              an attacker to review or execute commands in the
           local Database (according to the web server's 
        configuration)

[+] PoC :     It's posible to check if the app is vulnerable
          by trying something like: 100000000 or 1=2 on
              the "Price From" form, as the second part of the
         injection is never true, the app won't show any
       results; although if the injection is crafted as
           100000000 or 1=1, the app will show every product
          on its database.





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.