CVE-2018-1000558 - OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authenticated attacker is able to gain full access to data stored within database

Back Back to CVE browser

MEDIUM

OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authenticated attacker is able to gain full access to data stored within database

Published Jun 26, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.01%

Description

OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authenticated attacker is able to gain full access to data stored within database. This attack appear to be exploitable via By sending crafted requests it is possible to gain database access. This vulnerability appears to have been fixed in 2.4.1.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/
x_refsource_MISCRelease NotesVendor Advisory
https://www.secuvera.de/advisories/secuvera-SA-2017-04.txt
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/		x_refsource_MISCRelease NotesVendor Advisory
https://www.secuvera.de/advisories/secuvera-SA-2017-04.txt		x_refsource_MISCExploitThird Party Advisory