{"vuid":"VU#368300","idnumber":"368300","name":"Hummingbird CyberDOCS vulnerable to SQL injection","keywords":["Hummingbird","Cyberdocs","SQL injection","login screen","loginact.asp","dm","SD017068","DocsFusion"],"overview":"Hummingbird CyberDOCS contains an SQL injection vulnerability that could allow a remote attacker to execute SQL commands.","clean_desc":"Hummingbird CyberDOCS (Hummingbird DM) is a web-based enterprise document management solution that runs on Windows NT/2000 using SQL database technology. The login page (loginact.asp on IIS) does not properly filter user input, allowing a remote attacker to supply SQL commands that may be executed by the underlying database.","impact":"Depending on the configuration of the database system, an unauthenticated, remote attacker may be able to execute operating system commands, modify databases, or determine system configuration information.","resolution":"Upgrade\nThis vulnerability does not exist in CyberDOCS 3.9 or later. Hummingbird recommends that customers upgrade to the most recent version of CyberDOCS.","workarounds":"Limit SQL database user privileges To limit the effects of a successful attack, configure SQL databases to run with limited user privileges.","sysaffected":"","thanks":"This vulnerability was discovered and reported by ProCheckUp.","author":"This document was written by Art Manion.","public":["http://www.procheckup.com/security_info/vuln_pr0304.html","http://www.sqlsecurity.com/DesktopDefault.aspx?tabindex=2&tabid=3"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2003-09-02T13:15:51Z","publicdate":"2003-10-06T00:00:00Z","datefirstpublished":"2003-10-09T16:21:17Z","dateupdated":"2003-10-09T16:24:29Z","revision":23,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"14","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"2","cam_impact":"17","cam_easeofexploitation":"17","cam_attackeraccessrequired":"20","cam_scorecurrent":"3.9015","cam_scorecurrentwidelyknown":"5.202","cam_scorecurrentwidelyknownexploited":"9.537","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":3.9015,"vulnote":null}