Openbiz Cubi SQL Injection

Openbiz Cubi SQL Injection

Openbiz Cubi - Multiple SQL Injection
Advisory ID: Openbiz Cubi SQL Injection

Openbiz Cubi - Multiple SQL Injection
Advisory ID: RO-14-009
Severity: Critical
Vendor: Openbiz
Product: Openbiz Cubi
Version: *


Overview #

Multiple SQL Injection vulnerabilities exist in Openbiz Cubi. These vulnerabilities allow remote attackers to execute arbitrary SQL commands and potentially compromise the entire database.


Vulnerability Details #

Affected Versions: All versions

Root Cause: Insufficient input validation on multiple parameters allows SQL Injection attacks.


Exploitation Requirements #

No authentication required for some vectors
Direct access to vulnerable endpoints

Impact #

Remote attackers can exploit these vulnerabilities to:

Extract sensitive data from the database
Bypass authentication mechanisms
Modify or delete database content
Potentially gain administrative access

Proof of Concept #

Details available upon request.


Solution #

Apply vendor patches or implement proper input sanitization and parameterized queries.


References #

Vendor notification sent

Timeline:

[2014-01-01] - Discovered

Credits: Omar Kurt