exploit the possibilities

DataWatch Monarch Business Intelligence (BI) 5.1 Blind XPath Injection

DataWatch Monarch Business Intelligence (BI) 5.1 Blind XPath Injection
Posted Jul 31, 2012
Authored by Dionach

DataWatch Monarch Business Intelligence (BI) version 5.1 suffers from a blind XPath injection vulnerability in the administrative section.

tags | exploit
MD5 | dcc1fefa6e970e28000a5bd6ceab60ee

DataWatch Monarch Business Intelligence (BI) 5.1 Blind XPath Injection

Change Mirror Download
DataWatch Monarch BI v5.1 admin section blind XPath injection 

Class: Input Validation Error
Remote: Yes
Local: No
Published: 26/06/2012
Credit: Raymond Rizk of Dionach Limited (vulns@dionach.com)

Vulnerable: DataWatch Monarch BI v5.1

DataWatch's Monarch BI admin section is prone to a blind XPath injection vulnerability because it fails to sproperly sanitize user-supplied input before using it in an XPath query.

An attacker may leverage this issue to access or modify data in an XML document.

DataWatch Monarch BI v5.1 is known to be vulnerable. Other versions may also be vulnerable.

Attackers can use a browser to exploit this issue. This can be seen in the following example

http://127.0.0.1/ESClient/jsp/customizedialog.jsp?templateType=-1&doctypeid=122&activetab=DM_DOCUMENT_LIST&fields=filter;sort;summary;&searchtype=document'&doclist.jsp

Vendor informed and a patch was released on 12/07/2012. Vendor recommends installing the latest security updates.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    11 Files
  • 17
    Sep 17th
    16 Files
  • 18
    Sep 18th
    8 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close