Menu

Search for hundreds of thousands of exploits

"Hornbill Supportworks ITSM 1.0.0 - SQL Injection"

Author

Exploit author

"Joseph Sheridan"

Platform

Exploit platform

php

Release date

Exploit published date

2013-04-25

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
Summary

 

SQL Injection Vulnerability in ITSM component of Hornbill Supportworks
Application

 

    CVE number: CVE-2013-2594

    Impact: High

    Vendor homepage: http://www.hornbill.com

    Vendor notified: 19/11/2012

    Vendor response: This issue has reportedly been fixed but the vendor
refused to give version details.

    Credit: Joseph Sheridan of ReactionIS

 

Affected Products

 

Supportworks ITSM versions 1.0.0 and possibly other versions

 

Details

 

There is a SQL injection vulnerability in the ITSM component of the
Supportworks Application. The vulnerable file is calldiary.php found in the
/reports folder of the webroot. The following URL demonstrates the issue:

 

 

http://vulnhost.com/reports/calldiary.php?callref=VULN 

 

This attack can be used to take full control of the host by writing a php
webshell document (using mysql 'into outfile') to the webroot.

 

 

Impact

 

An attacker may be able to take full control of the Supportworks server and
execute arbitrary operating-system commands.

 

Solution

 

Upgrade to the latest available ITSM version - contact Vendor for more
details.

 

http://www.reactionpenetrationtesting.co.uk 

http://www.reactionpenetrationtesting.co.uk/research.html 

http://www.reactionpenetrationtesting.co.uk/security-testing-services.html
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2013-04-25 "Hornbill Supportworks ITSM 1.0.0 - SQL Injection" webapps php "Joseph Sheridan"
2012-11-26 "Forescout CounterACT - 'a' Open Redirection" webapps multiple "Joseph Sheridan"
2012-10-04 "XnView 1.99.1 - '.JLS' File Decompression Heap Overflow" dos windows "Joseph Sheridan"
2012-06-30 "IrfanView JLS Formats PlugIn - Heap Overflow" dos windows "Joseph Sheridan"
2012-06-30 "GIMP 2.8.0 - '.FIT' File Format Denial of Service" dos multiple "Joseph Sheridan"
2012-05-31 "GIMP 2.6 script-fu < 2.8.0 - Buffer Overflow (PoC)" dos windows "Joseph Sheridan" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected