Skip to content

Instantly share code, notes, and snippets.

@fir3storm

fir3storm/gist:c8a013d1231c22e22835566609620afd

Created May 19, 2023 14:10
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save fir3storm/c8a013d1231c22e22835566609620afd to your computer and use it in GitHub Desktop.
Save fir3storm/c8a013d1231c22e22835566609620afd to your computer and use it in GitHub Desktop.
Download ZIP
Zero-Day Vulnerability Identified in Credence Analytics - iDEAL - Wealth and Funds - V1.0
Raw
gistfile1.txt
[description]
SQL injection in "/Framewrk/Home.jsp" file (POST method) in "tCredence" allows authenticated remote attackers to inject payload via "v" parameter.
------------------------------------------
[Vulnerability Type]
SQL Injection
------------------------------------------
[Vendor of Product]
Credence Analytics
------------------------------------------
[Affected Product Code Base]
iDEAL - Wealth and Funds - 1.0
------------------------------------------
[Affected Component]
*/Framewrk/Home.jsp
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Code execution]
true
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
A remote authenticated session can be used to successfully execute the SQL Injection at the "/Framewrk/Home.jsp" file at the "v" parameter for complete data exfiltration.
------------------------------------------
[Reference]
https://www.credenceanalytics.com
------------------------------------------
[Discoverer]
Abhirup Guha
[CVE]
CVE-2022-30025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment