Home page logo

fulldisclosure logo Full Disclosure mailing list archives

DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection
From: ddivulnalert <ddivulnalert () ddifrontline com>
Date: Wed, 16 May 2012 13:54:17 -0500

DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection


Date Discovered
April 12, 2012

Discovered By
Digital Defense, Inc. Vulnerability Research Team
Credit: Chris Graham and r () b13$

Vulnerability Description
Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability in the Epicor Returns Management 
software SOAP interface. Left unremediated, this vulnerability could be leveraged by an attacker to execute arbitrary 
SQL commands and extract information from the backend database using standard SQL exploitation techniques. 
Additionally, an attacker may be able to leverage this flaw to compromise the database server host operating system.

Solution Description
Epicor Software Corporation has confirmed they have now contacted the customers affected, and have made an update 
available to address this vulnerability. As such, DDI recommends restricting access to the affected port/interface 
until installing the Epicor update or implementing another workaround to address the issue.

It should be noted that Epicor has advised DDI that the codebase for Returns Management software may differ 
significantly from customer to customer. Epicor has suggested that some customer installs may not contain this specific 
vulnerability as a result of this codebase variability.

DDI recommends that any customer currently utilizing Epicor Returns Management software within their enterprise install 
the update Epicor has made available and, if concerned about the applicability of the update, log a support call with 
Epicor directly to determine if their codebase contains this vulnerability.

Tested Systems / Software (with versions)
Epicor Returns Management
Windows Server 2003

Microsoft SQL Server 2000

Platform: Apache Tomcat/4.1.31

Vendor Contact
Epicor Software Corporation
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection ddivulnalert (May 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]