CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: a sql injection issue was discovered in sagecrm 7.x before 7.3 sp3. the ap_documentui.asp web resource includes utilityfuncs.js when the file is opened or viewed. this file crafts a sql statement to identify the database that is to be in use with the current user's session. the database variable can be populated from the url, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. the /crm/custompages/accpac/ap_documentui.asp?sid=<valid-sid>&database=1';waitfor delay '0:0:5'-- uri is a proof of concept.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-02-02
Last Modified Date: 2017-03-02