Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass
# Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. # Date: 28-05-2019 # Exploit Author: Faudhzan Rahman # Website: https://faudhzanrahman.blogspot.com/ # Vendor Homepage: http://www.petraware.com # Version: 2.0 # CVE : CVE-2019-12372 # Tested on: Windows 10 Pro *Description* The login form on pTransformer ADC does not filter dangerous character such as single quote ('). This has cause the application to be vulnerable to SQL Injection. *Proof-of-concept* The vulnerable parameter is User ID. By injecting ' or '1'='1'-- ,it will bypass the login form. *Reference* https://faudhzanrahman.blogspot.com/2019/05/sql-injection-on-login-form.html |