SolarWinds Storage Manager Server LoginServlet loginName Parameter SQL Injection

High Nessus Plugin ID 59116

Synopsis

The remote host is running a web application with a SQL injection vulnerability.

Description

The version of SolarWinds Storage Manager running on the remote host has a SQL injection vulnerability in the 'loginName' parameter of the 'LoginServlet' page. An attacker can leverage this flaw to bypass authentication, execute arbitrary SQL commands on the underlying database, and possibly compromise the database server host operating system.

Solution

Either apply the hotfix for version 5.1.2 or upgrade to version 5.2 or later.

See Also

https://www.securityfocus.com/archive/1/521328/30/0/threaded

http://www.nessus.org/u?ebb7ec6a

Plugin Details

Severity: High

ID: 59116

File Name: solarwinds_storagemanager_login_sql_injection.nasl

Version: 1.10

Type: remote

Family: CGI abuses

Published: 2012/05/16

Updated: 2018/11/15

Dependencies: 59115

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:solarwinds:storage_manager

Required KB Items: www/solarwinds_storage_manager

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 2012/02/07

Vulnerability Publication Date: 2012/01/23

Exploitable With

Metasploit (Solarwinds Storage Manager 5.1.0 SQL Injection)

Elliot (SolarWinds Storage Manager 5.1.2 SQL Injection)

Reference Information

BID: 51639

EDB-ID: 18818