Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:SQL:INJ:CVE-2018-12464-PRI |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Micro Focus Secure Messaging Gateway enginelist.php SQL Injection |
Release Date |
2018/09/06 |
Update Number |
3097 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Micro Focus Secure Messaging Gateway enginelist.php SQL Injection
This signature detects attempts to exploit a known SQL injection vulnerability in Micro Focus Secure Messaging Gateway. It is due to insufficient validation of user-supplied input. Successful exploitation results in the execution of arbitrary SQL queries on the underlying database, allowing for the creation of an attacker controlled account with administrator privileges.
Extended Description
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).
References