CVE-2017-6550 Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) Q...
CriticalCVSS 9.8
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) QUERY parameter to KK_LS9ReportingPortal/GetData.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kinsey infor-lawson | All versions | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20170310 CVE-2017-6550: Kinsey Infor-Lawson - Multiple SQL Injections exploit mailing-list third-party-advisory
- 96821 exploit third-party-advisory vdb-entry
- 41577 exploit third-party-advisory vdb-entry