Vulnerability Note VU#846103
Sungard eTRAKiT3 may be vulnerable to SQL injection
Original Release date: 06 Dec 2016 | Last revised: 12 Dec 2016

Overview
According to the reporter, the Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run a subset of SQL commands against the back-end database.

Description
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) – CVE-2016-6566
According to the reporter, the valueAsString parameter inside the JSON payload contained by the ucLogin_txtLoginId_ClientStat POST parameter is not properly validated.

An unauthenticated remote attacker may be able to modify the POST request and insert a SQL query which may then be executed by the backend server.

According to the reporter, eTRAKiT 3.2.1.17 was tested, but other versions may also be vulnerable.

Impact
A remote unauthenticated attacker may be able to run a subset of SQL commands against the back-end database.

Solution
Apply a patch

Sungard has provided the following statement:

SunGard Public Sector appreciates that this issue has been brought to our attention.   Our development team has addressed this report with a patch release.  Please contact the SunGard Public Sector TRAKiT Solutions division to request the patch release.  (858) 451-3030.

However, affected users may also consider the following workaround:
Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent SQLi attacks since the attack comes as an SQL request from a legitimate user’s host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedSungardAffected21 Oct 201612 Dec 2016If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal
8.0
E:POC/RL:U/RC:UR

Environmental
6.0
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://www.sungardps.com/solutions/trakit/

Credit

Thanks to Illumant for reporting this vulnerability.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2016-6566

Date Public:
06 Dec 2016

Date First Published:
06 Dec 2016

Date Last Updated:
12 Dec 2016

Document Revision:
33

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply