JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username...
Vulnerability Description
JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .rpt file, which allows remote authenticated users to execute certain standard stored procedures by referencing them in a user-written .rpt file, as demonstrated by using a stored procedure that provides the username and cleartext password of every account.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-2718
Credits & Attribution
No credits recorded in the NVD database.
References
- http://securitytracker.com/id?1016181
- http://www.securityfocus.com/archive/1/435352/100/0/threaded
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046398.html
- http://secunia.com/advisories/20342
- http://securityreason.com/securityalert/1000
- http://www.securityfocus.com/archive/1/435730/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26756
Affected Vendor
jiwa
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.