CVE-2021-44874

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report module exposes direct SQL commands via POST data in order to select data for report generation. A malicious actor can use the bi report endpoint as a direct SQL prompt under the authenticated user.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.systeam.com.br/cve/insecure%20design%20-%20sql%20manipulation-en.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dalmark:systeam_enterprise_resource_planning:2.22.8:build_1724:*:*:*:*:*:*

History

No history.

Information

Published : 2021-12-21 17:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-44874

Mitre link : CVE-2021-44874

CVE.ORG link : CVE-2021-44874

JSON object : View

Products Affected

dalmark

systeam_enterprise_resource_planning

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2021-44874", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-12-21T17:15:08.473", "references": [{"url": "https://www.systeam.com.br/cve/insecure%20design%20-%20sql%20manipulation-en.txt", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report module exposes direct SQL commands via POST data in order to select data for report generation. A malicious actor can use the bi report endpoint as a direct SQL prompt under the authenticated user."}, {"lang": "es", "value": "Dalmark Systems Systeam versi\u00f3n 2.22.8 build 1724, es vulnerable al dise\u00f1o no Seguro en la creaci\u00f3n de informes por medio de consultas SQL. La aplicaci\u00f3n Systeam es un sistema ERP que usa una arquitectura mixta basada en la administraci\u00f3n de usuarios e inquilinos SaaS, y en la base de datos local y las contrapartes de la aplicaci\u00f3n web. El m\u00f3dulo de informes bi expone comandos SQL directos por medio de datos POST con el fin de seleccionar datos para la generaci\u00f3n de informes. Un actor malicioso puede usar el endpoint de bi report como una solicitud directa de SQL bajo el usuario autenticado"}], "lastModified": "2021-12-27T19:20:12.757", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dalmark:systeam_enterprise_resource_planning:2.22.8:build_1724:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA84FF69-3864-4439-B930-7E9418418F14"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}