critical9.8Public exploit code
CVE-2018-16659
An issue was discovered in Rausoft ID.prove 2.95.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Rausoft ID.prove 2.95 - 'Username' SQL injection2018-09-27 · webapps · windows_x86-64
Impact
An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rausoft | Id.Prove | Version 2.95 |