Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass

• Exploit Database
• 138 阅读

• 作者： Faudhzan Rahman
  日期： 2019-05-28
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/46934/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  # Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. # Date: 28-05-2019 # Exploit Author: Faudhzan Rahman # Website: https://faudhzanrahman.blogspot.com/ # Vendor Homepage: http://www.petraware.com # Version: 2.0 # CVE : CVE-2019-12372 # Tested on: Windows 10 Pro   *Description*   The login form on pTransformer ADC does not filter dangerous character such as single quote ('). This has cause the application to be vulnerable to SQL Injection.   *Proof-of-concept*   The vulnerable parameter is User ID. By injecting ' or '1'='1'-- ,it will bypass the login form.   *Reference*   https://faudhzanrahman.blogspot.com/2019/05/sql-injection-on-login-form.html