// For flags

CVE-2017-3183

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Treasury is a business finance management application. Database user access privileges are determined by the USER_CODE field associated with the querying user. By modifying the USER_CODE value to match that of a privileged user, a low-privileged, authenticated user may gain privileged access to the SQL database. A remote, authenticated user can submit specially crafted SQL queries to gain privileged access to the application database.

Sage XRT Treasury, en su versión 3, no restringe correctamente el acceso a la base de datos a los usuarios autorizados, lo que podría hacer que cualquier usuario autenticado obtenga acceso total a las funciones privilegiadas de la base de datos. Sage XRT Treasury es una aplicación de gestión de financias empresariales. Los privilegios de acceso de usuario a la base de datos se determinan mediante el campo USER_CODE asociado al usuario que realiza la consulta. Al modificar el valor USER_CODE para que coincida con el de un usuario privilegiado, un usuario autenticado con pocos privilegios podría obtener acceso privilegiado a la base de datos SQL. Un usuario remoto autenticado puede enviar consultas SQL especialmente manipuladas para obtener acceso privilegiado a la base de datos de la aplicación.

*Credits: Thanks to Victor Portal Gonzalez of Deloitte Spain for reporting this vulnerability.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-12-05 CVE Reserved
  • 2018-07-24 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-09-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-639: Authorization Bypass Through User-Controlled Key
  • CWE-863: Incorrect Authorization
CAPEC
References (2)
URL Tag Source
https://www.kb.cert.org/vuls/id/742632 Third Party Advisory
https://www.securityfocus.com/bid/96477 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sage
Search vendor "Sage"
 Xrt Treasury
Search vendor "Sage" for product "Xrt Treasury"
 3.0
Search vendor "Sage" for product "Xrt Treasury" and version "3.0"
-
Affected