← Advisories

OV3 Online Administration 3.0 Multiple Unauthenticated SQL Injection Vulnerabilities

High
Advisory ID
ZSL-2017-5412
Release Date
30 May 2017
Vendor
novaCapta Software & Consulting GmbH - http://www.meacon.de
Affected Version
3.0
CVE
N/A
Tested On
CentOS release 6.8 (Final), PHP/5.3.3, Apache/2.2.15, MySQL/5.0.11
Summary

With the decision to use the OV3 as a platform for your data management, the course is set for scalable, flexible and high-performance applications. Whether you use the OV3 for your internal data management or use it for commercial business applications such as shops, portals, etc. Thanks to the data-based structure of the OV3, you always have the best tool at your fingertips. The OV3 is a 100% web-based tool. This eliminates the need to install a new software on all participating client computers. All elements are operated by a standard browser. Further advantages are the location-dependent use and - particularly with ASP solutions - the reduced costs for local hardware like own servers and modern client workstations.

Description

OV3 suffers from multiple SQL Injection vulnerabilities. Input passed via multiple GET and POST parameters, including the User-Agent HTTP header, is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Proof of Concept
Disclosure Timeline
14.11.2016Vendor contacted.
26.12.2016Vulnerability discovered.
29.05.2017No response from the vendor.
30.05.2017Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
30.05.2017Initial release
02.06.2017Added reference [1], [2] and [3]
08.06.2017Added reference [4]