Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:16841
HistoryApr 25, 2007 - 12:00 a.m.

Security Advisory: CA CleverPath SQL Injection

2007-04-2500:00:00
vulners.com
23

Background

The CA Clever Path Portal is a customizable portal for aggregation and
integration of data and applications. It is integrated into multiple CA
products including various Unicenter components. The CA CleverPath
utilizes a back end Database for storing data and allows usage of either
built in or external Database.

Scope

After identifying in CleverPath an irregular behavior when modifying
query parameters in the search mechanism, Hacktics has conducted a
research of identifying an SQL Injection vulnerability in the
implementation of the search query construction.

The Finding

By modifying certain parameters in the execute search URL, it was
possible to cause the application to send to the database queries that
are different than those originally intended by the search engine, and
as a result retrieving the entire database contents according to the
application user permissions scheme in the database.

Note: Due to the diversity of possible Database implementations for
CleverPath, the actual level of possible exploitation may vary between
different systems.

Exploit Details

Due to the complexity of the required syntax, the identified SQL
injection does not allow for trivial exploitation such as UNION SELECT.
However, data can be still retrieved using Binary Search techniques.

For detailed technical description and exploit please visit
http://www.hacktics.com/AdvCleverPathApr07.html

Affected Systems

Multiple CA products and 3rd party products utilizing the CleverPath
Portal.

Solution

CA Has been notified of this vulnerability on Januarty 18th, and is
releasing a patch together with the publication of the vulnerability.


Irene Abezgauz
Senior Consultant & Account Manager
Hacktics Ltd.
Mobile: +972-54-6545405
Web: http://www.hacktics.com/