CVE-2017-6550
📋 TL;DR
This CVE describes multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) software. Attackers can execute arbitrary SQL commands via TABLE or QUERY parameters in specific endpoints, potentially compromising database integrity and confidentiality. Organizations using affected Kinsey Infor-Lawson/ESBUS systems are vulnerable.
💻 Affected Systems
- Kinsey Infor-Lawson
- ESBUS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, data manipulation, privilege escalation, and potential remote code execution on the database server.
Likely Case
Unauthorized data access, data exfiltration, and potential application-level compromise.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Public exploit code available, simple HTTP requests with SQL injection payloads in parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Contact Kinsey/Infor-Lawson vendor for patches or updates. 2. Apply vendor-provided fixes. 3. Test in non-production environment first.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests to vulnerable endpoints.
Input Validation Filter
allImplement input validation to reject suspicious characters in TABLE and QUERY parameters.
🧯 If You Can't Patch
- Block access to vulnerable endpoints (esbus/servlet/GetSQLData and KK_LS9ReportingPortal/GetData) at network perimeter.
- Implement strict network segmentation to isolate affected systems from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Test endpoints with SQL injection payloads: Send HTTP requests to /esbus/servlet/GetSQLData?TABLE=test' OR '1'='1 and /KK_LS9ReportingPortal/GetData?QUERY=test' OR '1'='1Check Version:
Check application version through admin interface or contact vendor.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return error or sanitized responses.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /esbus/servlet/GetSQLData or /KK_LS9ReportingPortal/GetData with SQL keywords in parameters
- Unusual database query patterns from application server
Network Indicators:
- HTTP traffic containing SQL injection patterns (UNION, SELECT, etc.) in GET parameters
SIEM Query:
source="web_logs" AND (uri_path="/esbus/servlet/GetSQLData" OR uri_path="/KK_LS9ReportingPortal/GetData") AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*1*1*")🔗 References
- http://packetstormsecurity.com/files/141575/Kinseys-Infor-Lawson-SQL-Injection.html
- http://seclists.org/fulldisclosure/2017/Mar/31
- http://www.securityfocus.com/bid/96821
- https://www.exploit-db.com/exploits/41577/
- http://packetstormsecurity.com/files/141575/Kinseys-Infor-Lawson-SQL-Injection.html
- http://seclists.org/fulldisclosure/2017/Mar/31
- http://www.securityfocus.com/bid/96821
- https://www.exploit-db.com/exploits/41577/
