Kwok Information Server Blind Sql Injection

##=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+##
|| ||
|| Advisory : Kwok Information Server Blind Sql Injection ||
|| Affected Version : 2.7.3 & 2.8.4 ||
|| Vendor : http://www.kwoksys.com/index.php ||
|| Risk : Medium ||
|| CVE-ID : 2013-5028 ||
|| Tested on Platform : Windows 7 ||
##=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+##

============

Product Description:

Kwok Information Server is an open source IT management system, providing a single application for managing IT assets,
software licenses, contracts, issues, contacts. Additional modules include portal, RSS, blogging. (from product home
page)

============

Vulnerability Description:

A Blind SQL Injection vulnerability has been detected in Kwok Information Server. Application failed to sanitize user
supplied input in parameters "hardwareType", "hardwareStatus" and "hardwareLocation" of
page hardware-index.

User must be authenticated to exploit this vulnerability.

This vulnerability was tested with Kwok Information Server 2.7.3 and 2.8.4. Other versions may also be affected.

=============

Impact:

Successful exploitation of this vulnerability will allow a remote authenticated attacker to extract
sensitive and confidential data from the database.

=============

Proof of Concept:

1]
Url: http://10.10.75.59:8080/kwok/IT/hardware-list.dll?cmd=search&hardwareType=49[Inject Payload Here]

2]
Url: http://10.10.75.59:8080/kwok/IT/hardware-list.dll?cmd=search&hardwareStatus=0[Inject Payload Here]

3]
Url: http://10.10.75.59:8080/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here]


=============

Solution:

This vulnerability has been fixed in version 2.8.5 of Kwok Information Server.

=============

Disclosure Timeline:
~Vendor notification: 31st July
~Vendor response: 31st July
~Vendor released updates: 7th August
~Public disclosure: 12th September
===========================================================================================================

Advisory discovered by: Yogesh Phadtare
Secur-I Research Group
http://securview.com/

References:

http://www.kwoksys.com/index.php