Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.

By
Hi All,

 Today I will share POC on vulnerability found during pentest.

 As per the title, I recently found SQL Injection vulnerability on a thick client. 

 To read more about thick client, click here : https://techterms.com/definition/thickclient

Thick clients, also called heavy clients, are full-featured computers that are connected to a network. While a thick client is fully functional without a network connection, it is only a "client" when it is connected to a server. The server may provide the thick client with programs and files that are not stored on the local machine's hard drive. 
  • Exploit Title:  Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
  • Details & Description: SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.
  • Product Affected: pTransformer ADC
  • Attack Type: Local
  • Vulnerable Version: 2.0
  • Fixed Version: 2.1.7.22827
  • CVE ID: CVE-2019-12372
The vulnerability was found on login form of the thick client. The vulnerable parameter is User ID. The application does not properly filter dangerous character such as single qoute (') resulting in the vulnerability.

Payload used: ' or '1'='1'--

Picture shows that injecting SQL statement into the login form

Picture shows that able to bypass login using the SQL statement

By using this vulnerability, I can bypass the login form and login as admin without giving any password. 

Also added link from exploit-db : https://www.exploit-db.com/exploits/46934

Big thanks to the vendor of the software Petraware Technologies which acted promptly to fixed the vulnerability upon receiving the report.

Credit: Special thanks to d3ck4 who helped me a lot on this matter.

Comments

  1. first postNovember 17, 2020 at 4:15 PM

    Thank you for this great article really helped me a lot in pointing out what’s wrong with my website and why it’s not ranking on google.

    ReplyDelete
  2. first postNovember 17, 2020 at 4:25 PM

    Great tips to become a reputed blogger. I agree, creating evergreen content with consistency is quite necessary.

    ReplyDelete
  3. BrandingNovember 23, 2020 at 3:27 PM

    You guys are doing nice work

    ReplyDelete
  4. Supertech PropertiesDecember 13, 2020 at 5:49 PM

    You guys are doing nice work

    ReplyDelete
  5. Supertech PropertiesDecember 13, 2020 at 5:50 PM

    You guys are doing nice work

    ReplyDelete
  6. hemaMay 19, 2021 at 6:41 PM

    Excellent article for the people who need information about this course.
    sas online course

    ReplyDelete
  7. alamFebruary 22, 2022 at 9:40 PM

    I recently came across your blog and have been reading along. I thought I would leave my first comment. I don't know what to say except that I have enjoyed reading. Nice blog. I will keep visiting this blog very often. Log4Shell

    ReplyDelete

Post a Comment

Popular posts from this blog

Setting up MobSF in Ubuntu 18.04

By
Image
Hi guys, It's been a while since I last updated the blog. Been busy. So, for today I will be giving guide on how to setup MobSF in Ubuntu 18.04 . There is a lot of guide out there about how to setup MobSF. I'm here to give out step by step guide to set it up as per my own experience. The main reason of using Ubuntu 18.04 is because it has a built-in Python 3.6 and pip3 version 9.0.1 which is the requirements to setup MobSF. It's pretty much simplify the process of setting up MobSF. *Note that this is a guide to setup MobSF for static analysis. For dynamic analysis, you can refer to MobSF page in github. MobSF also known as Mobile Security Framework is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing framework capable of performing static analysis, dynamic analysis, malware analysis and web API testing. Can further read about MobSF here:  https://github.com/MobSF/Mobile-Security-Framework-MobSF For Ubuntu 18.04 can be downloaded
Read more

Setting up RMS in Ubuntu 18.04

By
Image
Hi peeps, It's been a while since my last post. Been busy. So, for today I would like to share on how to setup RMS (Runtime Security Mobile) in Ubuntu 18.04. RMS -  https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security "Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime." "You can easily dump all the loaded classes and relative methods, hook everything on the fly, trace methods args and return value, load custom scripts and many other useful stuff." This is a continuation of my post here  https://faudhzanrahman.blogspot.com/2019/09/setting-up-mobsf-in-ubuntu-1804.html  where I did a setup on MobSF.  I'm currently trying to set a box where it contains all sort of testing tools specifically for mobile . Now I have both MobSF and RMS setup in this box which is the Ubuntu 18.04. The same reason of setting RMS in this box is because the requirements fits Ubuntu 18.04. T
Read more