Cyclope Employee Surveillance Solution v6.0 SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Cyclope-series Employee Surveillance Solution v6.0
Description:
--------------------------------------------------------------------------------
Cyclope Employee Surveillance Solution is an Employee monitoring software developed by Cyclope-Series.
 
Because index. php script input filtering error. The SQL injection vulnerability exists in the processing of many strings (especially the username string in the application logon table), which allows attackers to inject or operate SQL queries in the backend database, this exposes arbitrary data.
 
<* Source: loneferret

Link: http://www.exploit-db.com/exploits/20393/
Http://www.osvdb.org/84517
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
# PoC 1:
# MySql sleep for 5 seconds.
# No Authentication Required.
# Page:/index. php
# Form: login
# Vulnerable Parameter: username
# Username: x' or sleep (5) and '1' = '1
# Password: whatever

# As stated, nothing is checked before passing "username" to MySql.
# This results in MySql sleeping for 5 seconds, and a unsuccessful
# Attempt.

# PoC 2:
# Remote Code Execution
# No Authentication Required.
# Page:/index. php
# Form: login
# Vulnerable Parameter: username

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Cyclope-series
--------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.cyclope-series.com/download/index.html