Ecava IntegraXor 5.0.413.0 getdata Requests Handling Multiple SQLi

High Nessus Plugin ID 97327

Synopsis

A SCADA application installed on the remote Windows host is affected by multiple SQL injection vulnerabilities.

Description

The version of Ecava IntegraXor installed on the remote Windows host is version 5.0.413.0. It is, therefore, affected by the following vulnerabilities :

- A SQL injection vulnerability exists in the web server component due to improper sanitization of user-supplied input to the 'name' parameter in getdata requests. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries, resulting in the disclosure or manipulation of arbitrary data.
(CVE-2016-8341 / ZDI-17-058)

- A SQL injection vulnerability exists in the web server component due to improper sanitization of user-supplied input to the 'param' parameter in getdata requests. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries, resulting in the disclosure or manipulation of arbitrary data.
(CVE-2016-8341 / ZDI-17-059)

Solution

Upgrade to Ecava IntegraXor version 5.2.722.2 or later.

See Also

http://www.nessus.org/u?2a1f3927

http://www.nessus.org/u?fc85aa91

http://www.nessus.org/u?79c030b4

Plugin Details

Severity: High

ID: 97327

File Name: scada_app_ecava_integraxor_5_2_722_2.nbin

Version: $Revision: 1.14 $

Type: local

Family: SCADA

Published: 2017/02/22

Modified: 2018/07/19

Dependencies: 53548

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Vulnerability Information

CPE: cpe:/a:ecava:integraxor

Required KB Items: installed_sw/Ecava IntegraXor

Patch Publication Date: 2017/01/31

Vulnerability Publication Date: 2017/01/31

Reference Information

CVE: CVE-2016-8341

BID: 95907

ICSA: 17-031-02

ZDI: ZDI-17-058, ZDI-17-059