A blind SQL Injection vulnerability is detected in OpStor v7.4, Storage Area Network Monitoring. The vulnerability allows an attacker (remote) or local low privileged user account to execute a SQL commands on the affected application dbms. The vulnerability is located in raidMaps.do file with the bound vulnerable name parameter. Successful exploitation of the vulnerability results in dbms & application compromise. Exploitation requires no user inter action & without privileged user account.
--- SQL Exception Logs ---
Struts Exception Problem Details
Syntax error or access violation message from server:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
right syntax to use near 000123456789 ) at line 1
A persistent input validation vulnerability is detected in OpStor v7.4, Storage Area Network Monitoring. The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent). The persistent vulnerability is located in Alarm reporting module with the bound vulnerable subject parameters. Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation. Exploitation requires low user inter action & privileged user account.
Multiple non persistent cross site scripting vulnerability is detected in OpStor v7.4, Storage Area Network Monitoring. The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high required user inter action or local low privileged user account. The vulnerabilities are located in availability730.do with the bound vulnerable day & name parameters. Successful exploitation can result in account steal, client site phishing & client-side content request manipulation.
Proof of Concept:
The blind SQL injection vulnerability can be exploited by remote attackers without user inter action. For demonstration or reproduce ...
The persistent input validation vulnerability can be exploited by remote attackers with low required user inter action & low privileged user account. For demonstration or reproduce ...