Exploits / Vulnerability Discovered : 2019-05-28 |
Type : remote |
Platform : windows
This exploit / vulnerability Petraware ptransformer adc < 2.1.7.22827 login bypass is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL
Injection via the User ID parameter to the login form.
# Date: 28-05-2019
# Exploit Author: Faudhzan Rahman
# Website: https://faudhzanrahman.blogspot.com/
# Vendor Homepage: http://www.petraware.com
# Version: 2.0
# CVE : CVE-2019-12372
# Tested on: Windows 10 Pro
*Description*
The login form on pTransformer ADC does not filter dangerous character such
as single quote ('). This has cause the application to be vulnerable to SQL
Injection.
*Proof-of-concept*
The vulnerable parameter is User ID. By injecting ' or '1'='1'-- ,it will
bypass the login form.