41ea196761
12 changes to exploits/shellcodes Microsoft Edge - 'Array.filter' Info Leak Microsoft Edge - 'Array.filter' Information Leak Microsoft Edge Chakra JIT - Bound Check Elimination Bug Windows - Local Privilege Escalation Windows WMI - Recieve Notification Exploit (Metasploit) Microsoft Windows - Local Privilege Escalation Microsoft Windows WMI - Recieve Notification Exploit (Metasploit) Microsoft Xbox One 10.0.14393.2152 - Code Execution (PoC) Prime95 29.4b8 - Stack Buffer Overflow (SEH) DynoRoot DHCP - Client Command Injection Linux 4.8.0 < 4.8.0-46 - AF_PACKET packet_set_ring Privilege Escalation (Metasploit) Microsoft Edge (Windows 10) - 'chakra.dll' Info Leak / Type Confusion Remote Code Execution Microsoft Edge (Windows 10) - 'chakra.dll' Information Leak / Type Confusion Remote Code Execution Windows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code Execution (Metasploit) (MS17-010) Microsoft Windows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code Execution (Metasploit) (MS17-010) HPE iMC 7.3 - Remote Code Execution (Metasploit) Healwire Online Pharmacy 3.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery Monstra CMS before 3.0.4 - Cross-Site Scripting SAP NetWeaver Web Dynpro 6.4 < 7.5 - Information Disclosure Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery Cisco SA520W Security Appliance - Path Traversal SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion
47 lines
No EOL
1.5 KiB
Text
47 lines
No EOL
1.5 KiB
Text
# Application: SAP NetWeaver Web Dynpro 6.4 to 7.5 - Information disclosure
|
||
# Versions Affected: SAP NetWeaver 6.4 - 7.5
|
||
# Vendor URL: http://SAP.com
|
||
# Bugs: Information disclosure (Enumerate users)
|
||
# Sent: 2016-12-15
|
||
# Reported: 2016-12-15
|
||
# Date of Public Advisory: 09.02.2016
|
||
# Reference: SAP Security Note 2344524
|
||
# Author: Richard Alviarez (SIA Group)
|
||
# CVE: N/A
|
||
|
||
# 1. ADVISORY INFORMATION
|
||
# Title: SAP NetWeaver Web Dynpro – information disclosure (Enumerate users)
|
||
# Advisory ID: 2344524
|
||
# Risk: Medium
|
||
# Date published: 20.12.2016
|
||
|
||
# 2. VULNERABILITY DESCRIPTION
|
||
# Anonymous attacker can use a special HTTP request to get information
|
||
# about SAP NetWeaver users.
|
||
|
||
# 3. VULNERABLE PACKAGES
|
||
# SAP NetWeaver Web Dynpro 6.4 - 7.5
|
||
# Other versions are probably affected too, but they were not checked.
|
||
|
||
# 4. TECHNICAL DESCRIPTION
|
||
# A potential attacker can use the vulnerability in order to reveal
|
||
# information about user names,
|
||
# first and last names, and associated emails, this can provide an attacker
|
||
# with enough information
|
||
# to make a more accurate and effective attack
|
||
|
||
# Steps to exploit this vulnerability
|
||
|
||
1. Open
|
||
http://SAP/webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/ACreate
|
||
or
|
||
http://SAP/webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/com.sap.caf.eu.gp.example.timeoff.wd.create.ACreate
|
||
|
||
page on SAP server
|
||
|
||
2. Press "Change processor" button
|
||
|
||
3. and in the "find" section, put the initial or name to be searched,
|
||
followed by a *
|
||
|
||
You will get a list of SAP users and information. |