SQL Injection i-doit Pro (CVE-2014-1597)

[Stephan Rickauer <stephan.rickauer () csnc ch>]

#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2014-1597
# CSNC ID: CSNC-2014-003
# Product: i-doit
# Vendor:  synetics Gesellschaft für Systemintegration mbH
# Subject: SQL Injection
# Risk:    Very High
# Effect:  Remotely exploitable
# Author:  Stephan Rickauer (stephan.rickauer () csnc ch)
# Date:    February 17th 2014
#
#############################################################


Introduction:
-------------
Compass Security AG [3] discovered a security flaws in the i-doit CMDB
web application [2], which allows injection of arbitrary SQL code as
authenticated i-doit user.


Vulnerable:
-----------
i-doit Pro 1.2.4 and likely all prior versions including i-doit Open.


Description:
------------
The i-doit web application is vulnerable to SQL injection in at least 
one place. Exploiting this vulnerability leads to an authenticated user 
being able to inject arbitrary SQL statements, e.g. to dump the entire 
database.

The vulnerable resource is the 'objID' parameter:
http://localhost/?objID=1745' AND (SELECT 8137 FROM(SELECT COUNT(*) ...


Remediation:
------------
Upgrade to i-doit Pro 1.2.5. According to the vendor, the so called Open
flavour will no longer receive patches in its current branch.


Milestones:
-----------
2014-01-17  Vulnerability discovered, Vendor notified, CVE ID requested
2014-01-20  Acknowledgement of vulnerability by vendor and agreement of
            advisory release schedule. CVE ID assigned my MITRE.
2014-02-14  Release of patched vendor software version 1.2.5.
2014-02-17  Public release of this advisory.


References:
-----------
[1] http://www.i-doit.org
[2] http://www.i-doit.com
[3] http://www.csnc.ch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/