Openbiz Cubi - Multiple SQL Injection

Overview #

Multiple SQL Injection vulnerabilities exist in Openbiz Cubi. These vulnerabilities allow remote attackers to execute arbitrary SQL commands and potentially compromise the entire database.

Vulnerability Details #

Affected Versions: All versions

Root Cause: Insufficient input validation on multiple parameters allows SQL Injection attacks.

Exploitation Requirements #

• No authentication required for some vectors
• Direct access to vulnerable endpoints

Impact #

Remote attackers can exploit these vulnerabilities to:

• Extract sensitive data from the database
• Bypass authentication mechanisms
• Modify or delete database content
• Potentially gain administrative access

Proof of Concept #

Details available upon request.

Solution #

Apply vendor patches or implement proper input sanitization and parameterized queries.

References #

• Vendor notification sent

Timeline:

• [2014-01-01] - Discovered

Credits: Omar Kurt