Sign-up

ID

VAR-201104-0286


CVE

CVE-2011-1562


TITLE

Ecava IntegraXor HMI Vulnerabilities that bypass authentication

Trust: 0.8

sources: JVNDB: JVNDB-2011-001684

DESCRIPTION

Ecava IntegraXor HMI before n 3.60 (Build 4032) allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have reported this issue as SQL injection, but this might not be accurate. Ecava IntegraXor is a human interface product that uses HTML and SVG. Ecava IntegraXor is prone to an unspecified SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Versions prior to IntegraXor 3.60.4050 are vulnerable. ---------------------------------------------------------------------- Q1 Factsheets released: http://secunia.com/resources/factsheets/2011_vendor/ ---------------------------------------------------------------------- TITLE: IntegraXor SQL Database Insecure Permissions Security Issue SECUNIA ADVISORY ID: SA44105 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44105/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44105 RELEASE DATE: 2011-04-12 DISCUSS ADVISORY: http://secunia.com/advisories/44105/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44105/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44105 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A security issue has been reported in IntegraXor, which can be exploited by malicious people to disclose potentially sensitive information and manipulate certain data. SOLUTION: Update to version 3.6.4000.5. PROVIDED AND/OR DISCOVERED BY: The vendor credits Dan Rosenberg, Virtual Security Research (VSR). ORIGINAL ADVISORY: IntegraXor: http://www.integraxor.com/blog/security-issue-20101222-0700-vulnerability-note OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.88

sources: NVD: CVE-2011-1562 // JVNDB: JVNDB-2011-001684 // CNVD: CNVD-2011-1239 // BID: 47019 // IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d // IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d // PACKETSTORM: 100305

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d // IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-1239

AFFECTED PRODUCTS

vendor:ecavamodel:integraxorscope:eqversion:3.60

Trust: 1.5

vendor:ecavamodel:integraxorscope:lteversion:3.60

Trust: 1.0

vendor:ecavamodel:integraxorscope:eqversion:3.60.4032

Trust: 0.9

vendor:ecavamodel:integraxorscope:eqversion:3.6.4000.0

Trust: 0.9

vendor:ecavamodel:integraxorscope:eqversion:3.5.3900.10

Trust: 0.9

vendor:ecavamodel:integraxorscope:eqversion:3.5.3900.5

Trust: 0.9

vendor:ecavamodel:integraxorscope:eqversion:3.5

Trust: 0.9

vendor:ecavamodel:integraxorscope:ltversion:hmi 3.60

Trust: 0.8

vendor:integraxormodel: - scope:eqversion:*

Trust: 0.4

vendor:ecavamodel:integraxorscope:neversion:3.60.4050

Trust: 0.3

vendor:ecavamodel:integraxorscope:neversion:3.6.4000.5

Trust: 0.3

sources: IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d // IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-1239 // BID: 47019 // JVNDB: JVNDB-2011-001684 // CNNVD: CNNVD-201104-024 // NVD: CVE-2011-1562

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-1562
value: HIGH

Trust: 1.0

NVD: CVE-2011-1562
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201104-024
value: HIGH

Trust: 0.6

IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2011-1562
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d // IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2011-001684 // CNNVD: CNNVD-201104-024 // NVD: CVE-2011-1562

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.8

sources: JVNDB: JVNDB-2011-001684 // NVD: CVE-2011-1562

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201104-024

TYPE

SQL injection

Trust: 1.0

sources: IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d // IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201104-024

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-001684

PATCH
title:Security Issue SQL Unauthenticated Vulnerability Noteurl:http://www.integraxor.com/blog/security-issue-sql-unauthenticated-vulnerability-note
Trust: 0.8
title:Ecava IntegraXor patch for unknown SQL injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/3394
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-1239 // 
            
            
            
            JVNDB: JVNDB-2011-001684

EXTERNAL IDS
db:BIDid:47019
Trust: 3.3
db:ICS CERTid:ICSA-11-082-01
Trust: 3.3
db:NVDid:CVE-2011-1562
Trust: 3.1
db:VUPENid:ADV-2011-0761
Trust: 1.6
db:XFid:66306
Trust: 1.4
db:SECUNIAid:44105
Trust: 1.1
db:CNVDid:CNVD-2011-1239
Trust: 1.0
db:CNNVDid:CNNVD-201104-024
Trust: 1.0
db:JVNDBid:JVNDB-2011-001684
Trust: 0.8
db:CERT/CCid:HTTP://WWW.US-CERT.GOV/CONTROL_SYSTEMS/PDF/ICSA-11-082-01.PDF
Trust: 0.6
db:IVDid:1BC35CBE-2355-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:C65F51E6-1F9A-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:100305
Trust: 0.1
sources:
            
            
            IVD: 1bc35cbe-2355-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: c65f51e6-1f9a-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2011-1239 // 
            
            
            
            BID: 47019 // 
            
            
            
            JVNDB: JVNDB-2011-001684 // 
            
            
            
            PACKETSTORM: 100305 // 
            
            
            
            CNNVD: CNNVD-201104-024 // 
            
            
            
            NVD: CVE-2011-1562

REFERENCES
url:http://www.us-cert.gov/control_systems/pdf/icsa-11-082-01.pdf
Trust: 3.3
url:http://www.securityfocus.com/bid/47019
Trust: 2.4
url:http://www.integraxor.com/blog/security-issue-sql-unauthenticated-vulnerability-note
Trust: 1.9
url:http://www.vupen.com/english/advisories/2011/0761
Trust: 1.6
url:http://www.integraxor.com/blog/security-issue-20101222-0700-vulnerability-note
Trust: 1.4
url:http://xforce.iss.net/xforce/xfdb/66306
Trust: 1.4
url:http://twitter.com/#%21/djrbliss/status/50685527749431296
Trust: 1.0
url:http://secunia.com/advisories/44105
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/66306
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1562
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-1562
Trust: 0.8
url:http://twitter.com/#!/djrbliss/status/50685527749431296
Trust: 0.6
url:http://www.ecava.com/index.htm
Trust: 0.3
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/44105/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=44105
Trust: 0.1
url:http://secunia.com/advisories/44105/
Trust: 0.1
url:http://secunia.com/resources/factsheets/2011_vendor/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2011-1239 // 
            
            
            
            BID: 47019 // 
            
            
            
            JVNDB: JVNDB-2011-001684 // 
            
            
            
            PACKETSTORM: 100305 // 
            
            
            
            CNNVD: CNNVD-201104-024 // 
            
            
            
            NVD: CVE-2011-1562

CREDITS
Dan Rosenberg
Trust: 0.3
sources:
            
            
            BID: 47019

SOURCES
db:IVDid:1bc35cbe-2355-11e6-abef-000c29c66e3d
db:IVDid:c65f51e6-1f9a-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-1239
db:BIDid:47019
db:JVNDBid:JVNDB-2011-001684
db:PACKETSTORMid:100305
db:CNNVDid:CNNVD-201104-024
db:NVDid:CVE-2011-1562

LAST UPDATE DATE
2025-04-11T23:14:53.347000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2011-1239date:2011-03-25T00:00:00
db:BIDid:47019date:2011-04-11T11:35:00
db:JVNDBid:JVNDB-2011-001684date:2011-06-06T00:00:00
db:CNNVDid:CNNVD-201104-024date:2011-04-08T00:00:00
db:NVDid:CVE-2011-1562date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:1bc35cbe-2355-11e6-abef-000c29c66e3ddate:2011-03-25T00:00:00
db:IVDid:c65f51e6-1f9a-11e6-abef-000c29c66e3ddate:2011-03-25T00:00:00
db:CNVDid:CNVD-2011-1239date:2011-03-25T00:00:00
db:BIDid:47019date:2011-03-23T00:00:00
db:JVNDBid:JVNDB-2011-001684date:2011-06-06T00:00:00
db:PACKETSTORMid:100305date:2011-04-12T06:01:39
db:CNNVDid:CNNVD-201104-024date:2011-04-06T00:00:00
db:NVDid:CVE-2011-1562date:2011-04-05T15:19:35.587